From fffe99ecc8969999c101c3dd5965a856dd6e30f8 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Sat, 14 Nov 2026 07:48:38 +0100 Subject: [PATCH] NVD update 2026-11-14T06:48:33Z --- data/2026/CVE-2026-0327.json | 2 +- data/2026/CVE-2026-0330.json | 2 +- data/2026/CVE-2026-103813.json | 2 +- data/2026/CVE-2026-106140.json | 2 +- data/2026/CVE-2026-107522.json | 2 +- data/2026/CVE-2026-109091.json | 2 +- data/2026/CVE-2026-111521.json | 2 +- data/2026/CVE-2026-114558.json | 2 +- data/2026/CVE-2026-114559.json | 2 +- data/2026/CVE-2026-114561.json | 2 +- data/2026/CVE-2026-114562.json | 2 +- data/2026/CVE-2026-114563.json | 2 +- data/2026/CVE-2026-114564.json | 2 +- data/2026/CVE-2026-114565.json | 2 +- data/2026/CVE-2026-114566.json | 2 +- data/2026/CVE-2026-114567.json | 2 +- data/2026/CVE-2026-114568.json | 2 +- data/2026/CVE-2026-114569.json | 2 +- data/2026/CVE-2026-114713.json | 2 +- data/2026/CVE-2026-116323.json | 2 +- data/2026/CVE-2026-116326.json | 2 +- data/2026/CVE-2026-116328.json | 2 +- data/2026/CVE-2026-116329.json | 2 +- data/2026/CVE-2026-116330.json | 2 +- data/2026/CVE-2026-118965.json | 2 +- data/2026/CVE-2026-119618.json | 2 +- data/2026/CVE-2026-120145.json | 2 +- data/2026/CVE-2026-120147.json | 2 +- data/2026/CVE-2026-120148.json | 2 +- data/2026/CVE-2026-120149.json | 2 +- data/2026/CVE-2026-120150.json | 2 +- data/2026/CVE-2026-120495.json | 2 +- data/2026/CVE-2026-12062.json | 2 +- data/2026/CVE-2026-121374.json | 2 +- data/2026/CVE-2026-121528.json | 2 +- data/2026/CVE-2026-123039.json | 2 +- data/2026/CVE-2026-124699.json | 2 +- data/2026/CVE-2026-124700.json | 2 +- data/2026/CVE-2026-124701.json | 2 +- data/2026/CVE-2026-124702.json | 2 +- data/2026/CVE-2026-124703.json | 2 +- data/2026/CVE-2026-124704.json | 2 +- data/2026/CVE-2026-124705.json | 2 +- data/2026/CVE-2026-124969.json | 1 + data/2026/CVE-2026-12507.json | 2 +- data/2026/CVE-2026-12591.json | 2 +- data/2026/CVE-2026-126144.json | 2 +- data/2026/CVE-2026-126145.json | 2 +- data/2026/CVE-2026-126146.json | 2 +- data/2026/CVE-2026-126147.json | 2 +- data/2026/CVE-2026-126148.json | 2 +- data/2026/CVE-2026-126151.json | 2 +- data/2026/CVE-2026-126153.json | 2 +- data/2026/CVE-2026-126158.json | 2 +- data/2026/CVE-2026-126160.json | 2 +- data/2026/CVE-2026-126162.json | 2 +- data/2026/CVE-2026-126163.json | 2 +- data/2026/CVE-2026-126164.json | 2 +- data/2026/CVE-2026-126166.json | 2 +- data/2026/CVE-2026-126167.json | 2 +- data/2026/CVE-2026-126168.json | 2 +- data/2026/CVE-2026-126169.json | 2 +- data/2026/CVE-2026-126170.json | 2 +- data/2026/CVE-2026-126171.json | 2 +- data/2026/CVE-2026-126173.json | 1 + data/2026/CVE-2026-126175.json | 2 +- data/2026/CVE-2026-126178.json | 2 +- data/2026/CVE-2026-126179.json | 2 +- data/2026/CVE-2026-126216.json | 2 +- data/2026/CVE-2026-126217.json | 2 +- data/2026/CVE-2026-126229.json | 2 +- data/2026/CVE-2026-126235.json | 2 +- data/2026/CVE-2026-126261.json | 2 +- data/2026/CVE-2026-126852.json | 2 +- data/2026/CVE-2026-126881.json | 2 +- data/2026/CVE-2026-55335.json | 2 +- data/2026/CVE-2026-56916.json | 2 +- data/2026/CVE-2026-61418.json | 2 +- data/2026/CVE-2026-76981.json | 2 +- data/2026/CVE-2026-82177.json | 2 +- data/2026/CVE-2026-86355.json | 2 +- data/2026/CVE-2026-86356.json | 2 +- data/2026/CVE-2026-91879.json | 2 +- state/sync.json | 2 +- 84 files changed, 84 insertions(+), 82 deletions(-) create mode 100644 data/2026/CVE-2026-124969.json create mode 100644 data/2026/CVE-2026-126173.json diff --git a/data/2026/CVE-2026-0327.json b/data/2026/CVE-2026-0327.json index 407cd6bb6a..7a4c60868e 100644 --- a/data/2026/CVE-2026-0327.json +++ b/data/2026/CVE-2026-0327.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Cloud NGFW","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]},{"cpes":["cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"PAN-OS","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.2.4-h2","status":"unaffected"}],"lessThan":"12.2.4-h2","status":"affected","version":"12.2.0","versionType":"custom"},{"changes":[{"at":"12.1.10-h4","status":"unaffected"}],"lessThan":"12.1.10-h4","status":"affected","version":"12.1.0","versionType":"custom"},{"changes":[{"at":"11.2.16-h2","status":"unaffected"}],"lessThan":"11.2.16-h2","status":"affected","version":"11.2.0","versionType":"custom"},{"changes":[{"at":"11.1.16-h5","status":"unaffected"}],"lessThan":"11.1.16-h5","status":"affected","version":"11.1.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Prisma Access","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.1.10-h4","status":"unaffected"}],"lessThan":"12.1.10-h4","status":"affected","version":"12.1.0","versionType":"custom"},{"status":"affected","version":"11.2.0","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user.\n\n\n\nCloud NGFW and Panorama are not affected by this vulnerability."}],"id":"CVE-2026-0327","lastModified":"2026-11-13T20:17:34.863","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T18:14:11.865052Z","version":"2.0.3"}}]},"published":"2026-11-11T20:17:02.240","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0327"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Cloud NGFW","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]},{"cpes":["cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"PAN-OS","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.2.4-h2","status":"unaffected"}],"lessThan":"12.2.4-h2","status":"affected","version":"12.2.0","versionType":"custom"},{"changes":[{"at":"12.1.10-h4","status":"unaffected"}],"lessThan":"12.1.10-h4","status":"affected","version":"12.1.0","versionType":"custom"},{"changes":[{"at":"11.2.16-h2","status":"unaffected"}],"lessThan":"11.2.16-h2","status":"affected","version":"11.2.0","versionType":"custom"},{"changes":[{"at":"11.1.16-h5","status":"unaffected"}],"lessThan":"11.1.16-h5","status":"affected","version":"11.1.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Prisma Access","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.1.10-h4","status":"unaffected"}],"lessThan":"12.1.10-h4","status":"affected","version":"12.1.0","versionType":"custom"},{"status":"affected","version":"11.2.0","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user.\n\n\n\nCloud NGFW and Panorama are not affected by this vulnerability."}],"id":"CVE-2026-0327","lastModified":"2026-11-14T05:18:08.850","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T20:17:02.240","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0327"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0330.json b/data/2026/CVE-2026-0330.json index 9a00a206a4..ae6054a9a8 100644 --- a/data/2026/CVE-2026-0330.json +++ b/data/2026/CVE-2026-0330.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Cloud NGFW","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]},{"cpes":["cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h33:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h40:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h39:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h38:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h38:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h37:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h26:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h24:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h42:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h41:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h40:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h39:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h38:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h37:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:Panorama:*"],"defaultStatus":"unaffected","platforms":["Panorama"],"product":"PAN-OS","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.2.4-h2","status":"unaffected"}],"lessThan":"12.2.4-h2","status":"affected","version":"12.2.0","versionType":"custom"},{"changes":[{"at":"12.1.10-h4","status":"unaffected"},{"at":"12.1.7-h12","status":"unaffected"},{"at":"12.1.4-h14","status":"unaffected"}],"lessThan":"12.1.10-h4","status":"affected","version":"12.1.0","versionType":"custom"},{"changes":[{"at":"11.2.16-h2","status":"unaffected"},{"at":"11.2.13-h5","status":"unaffected"},{"at":"11.2.10-h18","status":"unaffected"},{"at":"11.2.7-h24","status":"unaffected"},{"at":"11.2.4-h24","status":"unaffected"}],"lessThan":"11.2.16-h2","status":"affected","version":"11.2.0","versionType":"custom"},{"changes":[{"at":"11.1.16-h5","status":"unaffected"},{"at":"11.1.13-h17","status":"unaffected"},{"at":"11.1.10-h37","status":"unaffected"},{"at":"11.1.7-h13","status":"unaffected"},{"at":"11.1.6-h41","status":"unaffected"},{"at":"11.1.4-h39","status":"unaffected"}],"lessThan":"11.1.16-h5","status":"affected","version":"11.1.0","versionType":"custom"},{"changes":[{"at":"10.2.18-h14","status":"unaffected"},{"at":"10.2.16-h13","status":"unaffected"},{"at":"10.2.13-h28","status":"unaffected"},{"at":"10.2.10-h43","status":"unaffected"},{"at":"10.2.7-h40","status":"unaffected"}],"lessThan":"10.2.18-h14","status":"affected","version":"10.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Prisma Access","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.\n\n\n\nThe security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nCloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability."}],"id":"CVE-2026-0330","lastModified":"2026-11-13T20:17:38.870","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T18:11:09.138212Z","version":"2.0.3"}}]},"published":"2026-11-11T20:17:03.780","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0330"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Cloud NGFW","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]},{"cpes":["cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h33:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h40:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h39:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h38:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h38:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h37:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h26:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h24:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h42:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h41:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h40:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h39:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h38:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h37:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:Panorama:*","cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:Panorama:*"],"defaultStatus":"unaffected","platforms":["Panorama"],"product":"PAN-OS","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.2.4-h2","status":"unaffected"}],"lessThan":"12.2.4-h2","status":"affected","version":"12.2.0","versionType":"custom"},{"changes":[{"at":"12.1.10-h4","status":"unaffected"},{"at":"12.1.7-h12","status":"unaffected"},{"at":"12.1.4-h14","status":"unaffected"}],"lessThan":"12.1.10-h4","status":"affected","version":"12.1.0","versionType":"custom"},{"changes":[{"at":"11.2.16-h2","status":"unaffected"},{"at":"11.2.13-h5","status":"unaffected"},{"at":"11.2.10-h18","status":"unaffected"},{"at":"11.2.7-h24","status":"unaffected"},{"at":"11.2.4-h24","status":"unaffected"}],"lessThan":"11.2.16-h2","status":"affected","version":"11.2.0","versionType":"custom"},{"changes":[{"at":"11.1.16-h5","status":"unaffected"},{"at":"11.1.13-h17","status":"unaffected"},{"at":"11.1.10-h37","status":"unaffected"},{"at":"11.1.7-h13","status":"unaffected"},{"at":"11.1.6-h41","status":"unaffected"},{"at":"11.1.4-h39","status":"unaffected"}],"lessThan":"11.1.16-h5","status":"affected","version":"11.1.0","versionType":"custom"},{"changes":[{"at":"10.2.18-h14","status":"unaffected"},{"at":"10.2.16-h13","status":"unaffected"},{"at":"10.2.13-h28","status":"unaffected"},{"at":"10.2.10-h43","status":"unaffected"},{"at":"10.2.7-h40","status":"unaffected"}],"lessThan":"10.2.18-h14","status":"affected","version":"10.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Prisma Access","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.\n\n\n\nThe security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nCloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability."}],"id":"CVE-2026-0330","lastModified":"2026-11-14T05:18:14.270","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T20:17:03.780","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0330"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103813.json b/data/2026/CVE-2026-103813.json index 658cc6fe96..dfcb0057bc 100644 --- a/data/2026/CVE-2026-103813.json +++ b/data/2026/CVE-2026-103813.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance."}],"id":"CVE-2026-103813","lastModified":"2026-11-13T22:08:09.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T16:17:21.793","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance."}],"id":"CVE-2026-103813","lastModified":"2026-11-14T05:18:14.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T16:17:21.793","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106140.json b/data/2026/CVE-2026-106140.json index 205c8a46cb..791faf96f3 100644 --- a/data/2026/CVE-2026-106140.json +++ b/data/2026/CVE-2026-106140.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Reporting","vendor":"Progress Software","versions":[{"lessThan":"20.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations."}],"id":"CVE-2026-106140","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:26.987","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-106140"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Reporting","vendor":"Progress Software","versions":[{"lessThan":"20.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations."}],"id":"CVE-2026-106140","lastModified":"2026-11-14T05:18:16.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T10:17:26.987","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-106140"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107522.json b/data/2026/CVE-2026-107522.json index 84eb0528b7..0e39e8b8f3 100644 --- a/data/2026/CVE-2026-107522.json +++ b/data/2026/CVE-2026-107522.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator."}],"id":"CVE-2026-107522","lastModified":"2026-11-13T17:17:16.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:00:38.249829Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:29.357","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator."}],"id":"CVE-2026-107522","lastModified":"2026-11-14T05:18:16.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T15:17:29.357","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109091.json b/data/2026/CVE-2026-109091.json index b134eb5163..bfcb862554 100644 --- a/data/2026/CVE-2026-109091.json +++ b/data/2026/CVE-2026-109091.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote."}],"id":"CVE-2026-109091","lastModified":"2026-11-13T17:17:17.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109091","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:52:51.086125Z","version":"2.0.3"}}]},"published":"2026-11-13T16:17:25.453","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7"},{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"meissner@suse.de","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote."}],"id":"CVE-2026-109091","lastModified":"2026-11-14T05:18:17.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109091","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T16:17:25.453","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7"},{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"meissner@suse.de","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111521.json b/data/2026/CVE-2026-111521.json index b54741d62a..66d51dc998 100644 --- a/data/2026/CVE-2026-111521.json +++ b/data/2026/CVE-2026-111521.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Display and Peripheral Manager (DDPM Windows)","vendor":"Dell","versions":[{"lessThan":"2.4.0.17","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution."}],"id":"CVE-2026-111521","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T22:17:10.820","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527625/dsa-2026-482-security-update-for-dell-display-and-peripheral-manager-ddpm-windows-for-a-time-of-check-time-of-use-toctou-vulnerability"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Display and Peripheral Manager (DDPM Windows)","vendor":"Dell","versions":[{"lessThan":"2.4.0.17","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution."}],"id":"CVE-2026-111521","lastModified":"2026-11-14T05:18:18.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:10.820","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527625/dsa-2026-482-security-update-for-dell-display-and-peripheral-manager-ddpm-windows-for-a-time-of-check-time-of-use-toctou-vulnerability"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114558.json b/data/2026/CVE-2026-114558.json index 0467a4dcea..febfd27f15 100644 --- a/data/2026/CVE-2026-114558.json +++ b/data/2026/CVE-2026-114558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738."}],"id":"CVE-2026-114558","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.417","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114558"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-886/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738."}],"id":"CVE-2026-114558","lastModified":"2026-11-14T05:18:18.383","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:08.417","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114558"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-886/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114559.json b/data/2026/CVE-2026-114559.json index 8415dac8b1..89da003827 100644 --- a/data/2026/CVE-2026-114559.json +++ b/data/2026/CVE-2026-114559.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431."}],"id":"CVE-2026-114559","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.560","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114559"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-876/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431."}],"id":"CVE-2026-114559","lastModified":"2026-11-14T05:18:18.770","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:08.560","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114559"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-876/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114561.json b/data/2026/CVE-2026-114561.json index 3345904bf6..47d2a19249 100644 --- a/data/2026/CVE-2026-114561.json +++ b/data/2026/CVE-2026-114561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30433."}],"id":"CVE-2026-114561","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.843","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114561"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-878/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30433."}],"id":"CVE-2026-114561","lastModified":"2026-11-14T05:18:18.933","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:08.843","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114561"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-878/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114562.json b/data/2026/CVE-2026-114562.json index eee4d8c651..2fa9215724 100644 --- a/data/2026/CVE-2026-114562.json +++ b/data/2026/CVE-2026-114562.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30736."}],"id":"CVE-2026-114562","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.980","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114562"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-879/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30736."}],"id":"CVE-2026-114562","lastModified":"2026-11-14T05:18:19.123","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:08.980","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114562"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-879/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114563.json b/data/2026/CVE-2026-114563.json index 3f0374b720..33d6a40976 100644 --- a/data/2026/CVE-2026-114563.json +++ b/data/2026/CVE-2026-114563.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737."}],"id":"CVE-2026-114563","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.110","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114563"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-880/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737."}],"id":"CVE-2026-114563","lastModified":"2026-11-14T05:18:19.323","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.110","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114563"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-880/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114564.json b/data/2026/CVE-2026-114564.json index 9c17e6c566..1d7de6e6f8 100644 --- a/data/2026/CVE-2026-114564.json +++ b/data/2026/CVE-2026-114564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30768."}],"id":"CVE-2026-114564","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.250","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114564"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-881/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30768."}],"id":"CVE-2026-114564","lastModified":"2026-11-14T05:18:19.510","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114564","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.250","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114564"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-881/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114565.json b/data/2026/CVE-2026-114565.json index 815eaafb10..4c0c2d5369 100644 --- a/data/2026/CVE-2026-114565.json +++ b/data/2026/CVE-2026-114565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30769."}],"id":"CVE-2026-114565","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.397","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114565"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-882/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30769."}],"id":"CVE-2026-114565","lastModified":"2026-11-14T05:18:19.707","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.397","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114565"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-882/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114566.json b/data/2026/CVE-2026-114566.json index ff75af21b4..6f8918144e 100644 --- a/data/2026/CVE-2026-114566.json +++ b/data/2026/CVE-2026-114566.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30770."}],"id":"CVE-2026-114566","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.527","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114566"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-883/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30770."}],"id":"CVE-2026-114566","lastModified":"2026-11-14T05:18:19.867","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.527","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114566"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-883/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114567.json b/data/2026/CVE-2026-114567.json index 2a48624907..1c6c87c35c 100644 --- a/data/2026/CVE-2026-114567.json +++ b/data/2026/CVE-2026-114567.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30771."}],"id":"CVE-2026-114567","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.657","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114567"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-884/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30771."}],"id":"CVE-2026-114567","lastModified":"2026-11-14T05:18:20.810","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.657","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114567"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-884/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114568.json b/data/2026/CVE-2026-114568.json index 156ad0d041..6d5e89ec7a 100644 --- a/data/2026/CVE-2026-114568.json +++ b/data/2026/CVE-2026-114568.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31587."}],"id":"CVE-2026-114568","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.783","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114568"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-885/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31587."}],"id":"CVE-2026-114568","lastModified":"2026-11-14T05:18:22.617","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.783","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114568"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-885/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114569.json b/data/2026/CVE-2026-114569.json index 88f9f99339..8ecad45087 100644 --- a/data/2026/CVE-2026-114569.json +++ b/data/2026/CVE-2026-114569.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430."}],"id":"CVE-2026-114569","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.917","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114569"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-875/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430."}],"id":"CVE-2026-114569","lastModified":"2026-11-14T05:18:24.090","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T03:17:09.917","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114569"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-875/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114713.json b/data/2026/CVE-2026-114713.json index 0a2cb9757a..45517529bc 100644 --- a/data/2026/CVE-2026-114713.json +++ b/data/2026/CVE-2026-114713.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["labeled-response"],"product":"UnrealIRCd","programFiles":["src/modules/labeled-response.c"],"programRoutines":[{"name":"labeled_response_mtag_is_ok()"}],"repo":"https://github.com/unrealircd/unrealircd","vendor":"UnrealIRCd","versions":[{"lessThan":"6.2.7.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cisaActionDue":"2026-11-16","cisaExploitAdd":"2026-11-13","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"UnrealIRCd Improper Neutralization of Delimiters Vulnerability","cveTags":[],"descriptions":[{"lang":"en","value":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority."}],"id":"CVE-2026-114713","lastModified":"2026-11-13T20:17:50.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114713","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:16:29.356444Z","version":"2.0.3"}}]},"published":"2026-11-08T03:16:33.410","references":[{"source":"cve@mitre.org","url":"https://forums.unrealircd.org/viewtopic.php?t=9487"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/index/news"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/08/1"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-140"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["labeled-response"],"product":"UnrealIRCd","programFiles":["src/modules/labeled-response.c"],"programRoutines":[{"name":"labeled_response_mtag_is_ok()"}],"repo":"https://github.com/unrealircd/unrealircd","vendor":"UnrealIRCd","versions":[{"lessThan":"6.2.7.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cisaActionDue":"2026-11-16","cisaExploitAdd":"2026-11-13","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"UnrealIRCd Improper Neutralization of Delimiters Vulnerability","cveTags":[],"descriptions":[{"lang":"en","value":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority."}],"id":"CVE-2026-114713","lastModified":"2026-11-14T05:18:24.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114713","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-08T03:16:33.410","references":[{"source":"cve@mitre.org","url":"https://forums.unrealircd.org/viewtopic.php?t=9487"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/index/news"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/08/1"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114713"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-140"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116323.json b/data/2026/CVE-2026-116323.json index a49f4cad1a..aae969d81a 100644 --- a/data/2026/CVE-2026-116323.json +++ b/data/2026/CVE-2026-116323.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116323","lastModified":"2026-11-13T21:17:37.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:28:12.666825Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.823","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116323/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116323","lastModified":"2026-11-14T05:18:26.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.823","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116323/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116326.json b/data/2026/CVE-2026-116326.json index 8e6aa0bb56..dcd64bcfd1 100644 --- a/data/2026/CVE-2026-116326.json +++ b/data/2026/CVE-2026-116326.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116326","lastModified":"2026-11-13T21:17:37.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:26:46.216443Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.077","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116326/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116326","lastModified":"2026-11-14T05:18:26.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.077","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116326/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116328.json b/data/2026/CVE-2026-116328.json index 0c2bd37c2d..4a8cf4c5b0 100644 --- a/data/2026/CVE-2026-116328.json +++ b/data/2026/CVE-2026-116328.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-116328","lastModified":"2026-11-13T21:17:37.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:24:56.822534Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116328/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-116328","lastModified":"2026-11-14T05:18:27.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116328/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116329.json b/data/2026/CVE-2026-116329.json index a90b6d6981..6531fcd3e5 100644 --- a/data/2026/CVE-2026-116329.json +++ b/data/2026/CVE-2026-116329.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116329","lastModified":"2026-11-13T21:17:37.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116329","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:23:47.889772Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.437","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116329/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116329","lastModified":"2026-11-14T05:18:27.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116329","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.437","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116329/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116330.json b/data/2026/CVE-2026-116330.json index c85d633ae8..994f097bea 100644 --- a/data/2026/CVE-2026-116330.json +++ b/data/2026/CVE-2026-116330.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116330","lastModified":"2026-11-13T21:17:37.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:22:37.964637Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.557","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116330/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116330","lastModified":"2026-11-14T05:18:28.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.557","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116330/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118965.json b/data/2026/CVE-2026-118965.json index 706f8fa4ef..b235faa8b9 100644 --- a/data/2026/CVE-2026-118965.json +++ b/data/2026/CVE-2026-118965.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Checkmk","vendor":"Checkmk GmbH","versions":[{"lessThan":"2.5.0p19","status":"affected","version":"2.5.0","versionType":"semver"},{"lessThan":"2.4.0p40","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"affected","version":"2.3.0","versionType":"semver"}]}],"source":"security@checkmk.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user."}],"id":"CVE-2026-118965","lastModified":"2026-11-11T11:17:13.223","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@checkmk.com","type":"Secondary"}]},"published":"2026-11-11T11:17:13.080","references":[{"source":"security@checkmk.com","url":"https://checkmk.com/werk/22120"}],"sourceIdentifier":"security@checkmk.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@checkmk.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Checkmk","vendor":"Checkmk GmbH","versions":[{"lessThan":"2.5.0p19","status":"affected","version":"2.5.0","versionType":"semver"},{"lessThan":"2.4.0p40","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"affected","version":"2.3.0","versionType":"semver"}]}],"source":"security@checkmk.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user."}],"id":"CVE-2026-118965","lastModified":"2026-11-14T05:18:28.710","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@checkmk.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118965","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T11:17:13.080","references":[{"source":"security@checkmk.com","url":"https://checkmk.com/werk/22120"}],"sourceIdentifier":"security@checkmk.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@checkmk.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119618.json b/data/2026/CVE-2026-119618.json index 2ca7c40898..b4faea2763 100644 --- a/data/2026/CVE-2026-119618.json +++ b/data/2026/CVE-2026-119618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","matchCriteriaId":"EA2A33DB-23BB-4A27-9579-7EB1A977580C","versionEndExcluding":"2.4.71","versionStartIncluding":"2.4.55","vulnerable":true},{"criteria":"cpe:2.3:a:icing:mod_http2:*:*:*:*:*:apache_httpd:*:*","matchCriteriaId":"C1F96999-0729-4CBE-80D1-F7AC6A24301E","versionEndExcluding":"2.0.42","versionStartIncluding":"2.0.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-13T18:44:55.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:17:15.903768Z","version":"2.0.3"}}]},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","tags":["Patch","Vendor Advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://ubuntu.com/security/CVE-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"],"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","matchCriteriaId":"EA2A33DB-23BB-4A27-9579-7EB1A977580C","versionEndExcluding":"2.4.71","versionStartIncluding":"2.4.55","vulnerable":true},{"criteria":"cpe:2.3:a:icing:mod_http2:*:*:*:*:*:apache_httpd:*:*","matchCriteriaId":"C1F96999-0729-4CBE-80D1-F7AC6A24301E","versionEndExcluding":"2.0.42","versionStartIncluding":"2.0.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-14T05:18:29.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","tags":["Patch","Vendor Advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://ubuntu.com/security/CVE-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"],"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120145.json b/data/2026/CVE-2026-120145.json index 55235bc2bb..e5164b609a 100644 --- a/data/2026/CVE-2026-120145.json +++ b/data/2026/CVE-2026-120145.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120145","lastModified":"2026-11-13T20:17:53.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:27:09.508002Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.060","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120145/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120145","lastModified":"2026-11-14T05:18:30.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.060","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120145/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120147.json b/data/2026/CVE-2026-120147.json index f1b50a9bb7..4359fa55b2 100644 --- a/data/2026/CVE-2026-120147.json +++ b/data/2026/CVE-2026-120147.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120147","lastModified":"2026-11-13T20:17:54.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120147","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:23:55.989324Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.317","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120147/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120147","lastModified":"2026-11-14T05:18:30.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120147","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.317","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120147/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120148.json b/data/2026/CVE-2026-120148.json index 67a8156f2d..4b58d7348e 100644 --- a/data/2026/CVE-2026-120148.json +++ b/data/2026/CVE-2026-120148.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120148","lastModified":"2026-11-13T20:17:55.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:25:24.552400Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.443","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120148/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120148","lastModified":"2026-11-14T05:18:30.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.443","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120148/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120149.json b/data/2026/CVE-2026-120149.json index c9ee3bf9a4..6af8669563 100644 --- a/data/2026/CVE-2026-120149.json +++ b/data/2026/CVE-2026-120149.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120149","lastModified":"2026-11-13T20:17:56.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:26:15.530714Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.567","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120149/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120149","lastModified":"2026-11-14T05:18:30.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.567","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120149/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120150.json b/data/2026/CVE-2026-120150.json index 1e92f458b9..701d0c8a9d 100644 --- a/data/2026/CVE-2026-120150.json +++ b/data/2026/CVE-2026-120150.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120150","lastModified":"2026-11-13T20:17:58.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:23:26.284264Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.687","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120150/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120150","lastModified":"2026-11-14T05:18:30.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.687","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120150/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120495.json b/data/2026/CVE-2026-120495.json index c0f5114491..ad799739c7 100644 --- a/data/2026/CVE-2026-120495.json +++ b/data/2026/CVE-2026-120495.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Checkmk","vendor":"Checkmk GmbH","versions":[{"lessThan":"2.5.0p19","status":"affected","version":"2.5.0","versionType":"semver"},{"lessThan":"2.4.0p40","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"affected","version":"2.3.0","versionType":"semver"}]}],"source":"security@checkmk.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the Synthetic Monitoring \"Robotmk\" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user."}],"id":"CVE-2026-120495","lastModified":"2026-11-11T11:17:13.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@checkmk.com","type":"Secondary"}]},"published":"2026-11-11T11:17:13.433","references":[{"source":"security@checkmk.com","url":"https://checkmk.com/werk/22624"}],"sourceIdentifier":"security@checkmk.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security@checkmk.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Checkmk","vendor":"Checkmk GmbH","versions":[{"lessThan":"2.5.0p19","status":"affected","version":"2.5.0","versionType":"semver"},{"lessThan":"2.4.0p40","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"affected","version":"2.3.0","versionType":"semver"}]}],"source":"security@checkmk.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the Synthetic Monitoring \"Robotmk\" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user."}],"id":"CVE-2026-120495","lastModified":"2026-11-14T05:18:30.997","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@checkmk.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T11:17:13.433","references":[{"source":"security@checkmk.com","url":"https://checkmk.com/werk/22624"}],"sourceIdentifier":"security@checkmk.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security@checkmk.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12062.json b/data/2026/CVE-2026-12062.json index 8068c5f3bc..a0bf736158 100644 --- a/data/2026/CVE-2026-12062.json +++ b/data/2026/CVE-2026-12062.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8703","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API."}],"id":"CVE-2026-12062","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-11T08:17:17.960","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8703","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API."}],"id":"CVE-2026-12062","lastModified":"2026-11-14T05:18:40.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.960","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121374.json b/data/2026/CVE-2026-121374.json index 83fea613b5..2b0c5f9857 100644 --- a/data/2026/CVE-2026-121374.json +++ b/data/2026/CVE-2026-121374.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Checkmk","vendor":"Checkmk GmbH","versions":[{"lessThan":"2.5.0p19","status":"affected","version":"2.5.0","versionType":"semver"},{"lessThan":"2.4.0p40","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"affected","version":"2.3.0","versionType":"semver"}]}],"source":"security@checkmk.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the \"Exclude nodes based on their role\" rule option, leading to code execution as the site user."}],"id":"CVE-2026-121374","lastModified":"2026-11-11T11:17:14.487","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@checkmk.com","type":"Secondary"}]},"published":"2026-11-11T11:17:14.377","references":[{"source":"security@checkmk.com","url":"https://checkmk.com/werk/17994"}],"sourceIdentifier":"security@checkmk.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"security@checkmk.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Checkmk","vendor":"Checkmk GmbH","versions":[{"lessThan":"2.5.0p19","status":"affected","version":"2.5.0","versionType":"semver"},{"lessThan":"2.4.0p40","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"affected","version":"2.3.0","versionType":"semver"}]}],"source":"security@checkmk.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the \"Exclude nodes based on their role\" rule option, leading to code execution as the site user."}],"id":"CVE-2026-121374","lastModified":"2026-11-14T05:18:31.140","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@checkmk.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121374","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T11:17:14.377","references":[{"source":"security@checkmk.com","url":"https://checkmk.com/werk/17994"}],"sourceIdentifier":"security@checkmk.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"security@checkmk.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121528.json b/data/2026/CVE-2026-121528.json index 5a17cb83af..9072d71cf4 100644 --- a/data/2026/CVE-2026-121528.json +++ b/data/2026/CVE-2026-121528.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.9","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.4.16","status":"affected","version":"6.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website."}],"id":"CVE-2026-121528","lastModified":"2026-11-13T19:19:10.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.250","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-193"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.9","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.4.16","status":"affected","version":"6.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website."}],"id":"CVE-2026-121528","lastModified":"2026-11-14T05:18:31.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.250","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-193"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123039.json b/data/2026/CVE-2026-123039.json index affdf85293..9e493e9d52 100644 --- a/data/2026/CVE-2026-123039.json +++ b/data/2026/CVE-2026-123039.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cisaActionDue":"2026-11-16","cisaExploitAdd":"2026-11-13","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability","cveTags":[],"descriptions":[{"lang":"en","value":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."}],"id":"CVE-2026-123039","lastModified":"2026-11-13T20:18:14.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@checkpoint.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123039","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:16:35.345993Z","version":"2.0.3"}}]},"published":"2026-11-12T14:17:24.233","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000362"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-862"}],"source":"cve@checkpoint.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cisaActionDue":"2026-11-16","cisaExploitAdd":"2026-11-13","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability","cveTags":[],"descriptions":[{"lang":"en","value":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."}],"id":"CVE-2026-123039","lastModified":"2026-11-14T05:18:31.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@checkpoint.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123039","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T14:17:24.233","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000362"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-862"}],"source":"cve@checkpoint.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124699.json b/data/2026/CVE-2026-124699.json index cdb872eee1..c2900a94b6 100644 --- a/data/2026/CVE-2026-124699.json +++ b/data/2026/CVE-2026-124699.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124699","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:28.723","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124699"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124699","lastModified":"2026-11-14T05:18:31.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T10:17:28.723","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124699"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124700.json b/data/2026/CVE-2026-124700.json index e6d43b58a7..88348509ef 100644 --- a/data/2026/CVE-2026-124700.json +++ b/data/2026/CVE-2026-124700.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124700","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T18:17:22.537","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124700"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124700","lastModified":"2026-11-14T05:18:31.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T18:17:22.537","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124700"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124701.json b/data/2026/CVE-2026-124701.json index 5351cd5544..4f6d1e6066 100644 --- a/data/2026/CVE-2026-124701.json +++ b/data/2026/CVE-2026-124701.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124701","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.473","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124701","lastModified":"2026-11-14T05:18:31.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T11:17:10.473","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124702.json b/data/2026/CVE-2026-124702.json index 0adc0a1a36..47589e39d7 100644 --- a/data/2026/CVE-2026-124702.json +++ b/data/2026/CVE-2026-124702.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124702","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T18:17:22.683","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124702"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124702","lastModified":"2026-11-14T05:18:32.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T18:17:22.683","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124702"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124703.json b/data/2026/CVE-2026-124703.json index 516a9f0fe9..80e5551c0a 100644 --- a/data/2026/CVE-2026-124703.json +++ b/data/2026/CVE-2026-124703.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124703","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.743","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124703","lastModified":"2026-11-14T05:18:32.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T11:17:10.743","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124704.json b/data/2026/CVE-2026-124704.json index c78214ac36..199983b91f 100644 --- a/data/2026/CVE-2026-124704.json +++ b/data/2026/CVE-2026-124704.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124704","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.923","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124704"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124704","lastModified":"2026-11-14T05:18:32.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124704","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T11:17:10.923","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124704"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124705.json b/data/2026/CVE-2026-124705.json index d0ea702c7b..27cc4654ff 100644 --- a/data/2026/CVE-2026-124705.json +++ b/data/2026/CVE-2026-124705.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for .NET MAUI","vendor":"Progress Software","versions":[{"lessThan":"16.0.0","status":"affected","version":"5.2.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124705","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T12:18:22.260","references":[{"source":"security@progress.com","url":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for .NET MAUI","vendor":"Progress Software","versions":[{"lessThan":"16.0.0","status":"affected","version":"5.2.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124705","lastModified":"2026-11-14T05:18:32.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124705","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T12:18:22.260","references":[{"source":"security@progress.com","url":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124969.json b/data/2026/CVE-2026-124969.json new file mode 100644 index 0000000000..741b843e5e --- /dev/null +++ b/data/2026/CVE-2026-124969.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","vendor":"optimole","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires PEAR's Archive_Tar library to be present and loadable on the host (common in official WordPress Docker images and many PHP distributions), and an administrator must subsequently use the plugin's Rename control on any attachment after the attacker has staged a malicious payload in a comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own."}],"id":"CVE-2026-124969","lastModified":"2026-11-14T05:18:32.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-14T05:18:32.480","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.19/inc/media_rename/attachment_db_renamer.php#L319"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.19/inc/media_rename/attachment_db_renamer.php#L415"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.19/inc/media_rename/attachment_db_renamer.php#L548"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.19/inc/media_rename/attachment_edit.php#L311"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.19/inc/media_rename/attachment_rename.php#L107"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.20"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277b9a34-8e0b-496e-b07b-602b25f125d8?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@wordfence.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-12507.json b/data/2026/CVE-2026-12507.json index 33b8a53b1a..abf0631f4c 100644 --- a/data/2026/CVE-2026-12507.json +++ b/data/2026/CVE-2026-12507.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AssetExplorer","vendor":"Zohocorp","versions":[{"lessThan":"7860","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"Zohocorp","versions":[{"lessThan":"15290","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."}],"id":"CVE-2026-12507","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:46.750","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/service-desk/cve-2026-12507.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AssetExplorer","vendor":"Zohocorp","versions":[{"lessThan":"7860","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"Zohocorp","versions":[{"lessThan":"15290","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."}],"id":"CVE-2026-12507","lastModified":"2026-11-14T05:18:40.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T07:16:46.750","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/service-desk/cve-2026-12507.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12591.json b/data/2026/CVE-2026-12591.json index 4964a38b8c..5f5627005c 100644 --- a/data/2026/CVE-2026-12591.json +++ b/data/2026/CVE-2026-12591.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"M365 Manager Plus","vendor":"Zohocorp","versions":[{"lessThan":"4818","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}],"id":"CVE-2026-12591","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:47.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"M365 Manager Plus","vendor":"Zohocorp","versions":[{"lessThan":"4818","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}],"id":"CVE-2026-12591","lastModified":"2026-11-14T05:18:40.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-12T07:16:47.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126144.json b/data/2026/CVE-2026-126144.json index 2867317e2a..444dc5b16d 100644 --- a/data/2026/CVE-2026-126144.json +++ b/data/2026/CVE-2026-126144.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortivoice:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiVoice","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.4.2","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.5","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.8","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}],"id":"CVE-2026-126144","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.400","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortivoice:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiVoice","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.4.2","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.5","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.8","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}],"id":"CVE-2026-126144","lastModified":"2026-11-14T05:18:32.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126144","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.400","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126145.json b/data/2026/CVE-2026-126145.json index 1de2c44b9c..1b32ff45d6 100644 --- a/data/2026/CVE-2026-126145.json +++ b/data/2026/CVE-2026-126145.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root."}],"id":"CVE-2026-126145","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.580","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-197"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root."}],"id":"CVE-2026-126145","lastModified":"2026-11-14T05:18:32.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.580","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-197"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126146.json b/data/2026/CVE-2026-126146.json index c4056b383a..b2f847a6d3 100644 --- a/data/2026/CVE-2026-126146.json +++ b/data/2026/CVE-2026-126146.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"status":"affected","version":"7.6.0"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration."}],"id":"CVE-2026-126146","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"status":"affected","version":"7.6.0"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration."}],"id":"CVE-2026-126146","lastModified":"2026-11-14T05:18:33.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126146","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126147.json b/data/2026/CVE-2026-126147.json index a3fa0b360c..8ded6ae80e 100644 --- a/data/2026/CVE-2026-126147.json +++ b/data/2026/CVE-2026-126147.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126147","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.880","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-199"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126147","lastModified":"2026-11-14T05:18:34.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126147","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.880","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-199"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126148.json b/data/2026/CVE-2026-126148.json index 6ece97a810..2954e531b7 100644 --- a/data/2026/CVE-2026-126148.json +++ b/data/2026/CVE-2026-126148.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets."}],"id":"CVE-2026-126148","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.010","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-200"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets."}],"id":"CVE-2026-126148","lastModified":"2026-11-14T05:18:34.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126148","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:12.010","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-200"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126151.json b/data/2026/CVE-2026-126151.json index e7bb1698e1..715197c2ed 100644 --- a/data/2026/CVE-2026-126151.json +++ b/data/2026/CVE-2026-126151.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request."}],"id":"CVE-2026-126151","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request."}],"id":"CVE-2026-126151","lastModified":"2026-11-14T05:18:34.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126151","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:12.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126153.json b/data/2026/CVE-2026-126153.json index 689e7c11ac..4c42a6c6a2 100644 --- a/data/2026/CVE-2026-126153.json +++ b/data/2026/CVE-2026-126153.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests."}],"id":"CVE-2026-126153","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.050","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests."}],"id":"CVE-2026-126153","lastModified":"2026-11-14T05:18:35.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126153","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:13.050","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126158.json b/data/2026/CVE-2026-126158.json index a1d8f07e52..65db6edbe6 100644 --- a/data/2026/CVE-2026-126158.json +++ b/data/2026/CVE-2026-126158.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests."}],"id":"CVE-2026-126158","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.723","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-210"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests."}],"id":"CVE-2026-126158","lastModified":"2026-11-14T05:18:35.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:13.723","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-210"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126160.json b/data/2026/CVE-2026-126160.json index 4216fb649f..962cb2a981 100644 --- a/data/2026/CVE-2026-126160.json +++ b/data/2026/CVE-2026-126160.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests."}],"id":"CVE-2026-126160","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.990","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests."}],"id":"CVE-2026-126160","lastModified":"2026-11-14T05:18:36.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126160","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:13.990","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126162.json b/data/2026/CVE-2026-126162.json index a41714872d..5f9b328efa 100644 --- a/data/2026/CVE-2026-126162.json +++ b/data/2026/CVE-2026-126162.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126162","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.270","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126162","lastModified":"2026-11-14T05:18:36.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:14.270","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126163.json b/data/2026/CVE-2026-126163.json index b07ecd1c2c..4203b0b153 100644 --- a/data/2026/CVE-2026-126163.json +++ b/data/2026/CVE-2026-126163.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command."}],"id":"CVE-2026-126163","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.403","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command."}],"id":"CVE-2026-126163","lastModified":"2026-11-14T05:18:36.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126163","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:14.403","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126164.json b/data/2026/CVE-2026-126164.json index e318a8c061..b22f119bec 100644 --- a/data/2026/CVE-2026-126164.json +++ b/data/2026/CVE-2026-126164.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126164","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.537","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-216"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126164","lastModified":"2026-11-14T05:18:36.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126164","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:14.537","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-216"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126166.json b/data/2026/CVE-2026-126166.json index 759cc0299e..dc9244201c 100644 --- a/data/2026/CVE-2026-126166.json +++ b/data/2026/CVE-2026-126166.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126166","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.803","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126166","lastModified":"2026-11-14T05:18:36.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126166","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:14.803","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126167.json b/data/2026/CVE-2026-126167.json index 4caed3fe69..f8cf42dc90 100644 --- a/data/2026/CVE-2026-126167.json +++ b/data/2026/CVE-2026-126167.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126167","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.940","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126167","lastModified":"2026-11-14T05:18:36.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126167","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:14.940","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126168.json b/data/2026/CVE-2026-126168.json index 0022f42e6d..a1ecdd92fd 100644 --- a/data/2026/CVE-2026-126168.json +++ b/data/2026/CVE-2026-126168.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126168","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.067","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126168","lastModified":"2026-11-14T05:18:37.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:15.067","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126169.json b/data/2026/CVE-2026-126169.json index 5c563978c7..bafdb51972 100644 --- a/data/2026/CVE-2026-126169.json +++ b/data/2026/CVE-2026-126169.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126169","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126169","lastModified":"2026-11-14T05:18:37.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:15.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126170.json b/data/2026/CVE-2026-126170.json index 42b3dcfcc4..93ad51cb10 100644 --- a/data/2026/CVE-2026-126170.json +++ b/data/2026/CVE-2026-126170.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer-BigData","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request"}],"id":"CVE-2026-126170","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.340","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer-BigData","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request"}],"id":"CVE-2026-126170","lastModified":"2026-11-14T05:18:37.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126170","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:15.340","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126171.json b/data/2026/CVE-2026-126171.json index e3f55a372a..7108b71c8d 100644 --- a/data/2026/CVE-2026-126171.json +++ b/data/2026/CVE-2026-126171.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request"}],"id":"CVE-2026-126171","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.500","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request"}],"id":"CVE-2026-126171","lastModified":"2026-11-14T05:18:37.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:15.500","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126173.json b/data/2026/CVE-2026-126173.json new file mode 100644 index 0000000000..3d28b52908 --- /dev/null +++ b/data/2026/CVE-2026-126173.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AutomatorWP Webhooks","vendor":"AutomatorWP","versions":[{"lessThanOrEqual":"1.4.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration."}],"id":"CVE-2026-126173","lastModified":"2026-11-14T05:18:37.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-14T05:18:37.750","references":[{"source":"security@wordfence.com","url":"https://automatorwp.com/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ea5758-2400-4885-8342-c57d61206ef1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126175.json b/data/2026/CVE-2026-126175.json index 8d4d673536..a24cd65162 100644 --- a/data/2026/CVE-2026-126175.json +++ b/data/2026/CVE-2026-126175.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests."}],"id":"CVE-2026-126175","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.747","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests."}],"id":"CVE-2026-126175","lastModified":"2026-11-14T05:18:37.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:15.747","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126178.json b/data/2026/CVE-2026-126178.json index 1bbb925fd4..1d4ebc102e 100644 --- a/data/2026/CVE-2026-126178.json +++ b/data/2026/CVE-2026-126178.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request."}],"id":"CVE-2026-126178","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.370","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-223"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request."}],"id":"CVE-2026-126178","lastModified":"2026-11-14T05:18:38.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:16.370","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-223"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126179.json b/data/2026/CVE-2026-126179.json index fd21682788..1b43c8619f 100644 --- a/data/2026/CVE-2026-126179.json +++ b/data/2026/CVE-2026-126179.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests"}],"id":"CVE-2026-126179","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests"}],"id":"CVE-2026-126179","lastModified":"2026-11-14T05:18:38.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:16.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126216.json b/data/2026/CVE-2026-126216.json index f04e4a544b..88d73037b4 100644 --- a/data/2026/CVE-2026-126216.json +++ b/data/2026/CVE-2026-126216.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126216","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:19:12.350875Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.083","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126216","lastModified":"2026-11-14T05:18:38.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.083","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126217.json b/data/2026/CVE-2026-126217.json index 9f4382cf56..7aa556f414 100644 --- a/data/2026/CVE-2026-126217.json +++ b/data/2026/CVE-2026-126217.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126217","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.240","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126217","lastModified":"2026-11-14T05:18:38.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126217","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.240","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126229.json b/data/2026/CVE-2026-126229.json index fce76b5819..830244daf3 100644 --- a/data/2026/CVE-2026-126229.json +++ b/data/2026/CVE-2026-126229.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiAnalyzer Cloud 7.0 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager 7.0 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12, FortiManager Cloud 7.0 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."}],"id":"CVE-2026-126229","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.447","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiAnalyzer Cloud 7.0 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager 7.0 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12, FortiManager Cloud 7.0 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."}],"id":"CVE-2026-126229","lastModified":"2026-11-14T05:18:39.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:21.447","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126235.json b/data/2026/CVE-2026-126235.json index e0f31bc9ac..542617ae81 100644 --- a/data/2026/CVE-2026-126235.json +++ b/data/2026/CVE-2026-126235.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive."}],"id":"CVE-2026-126235","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive."}],"id":"CVE-2026-126235","lastModified":"2026-11-14T05:18:39.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126235","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:22.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126261.json b/data/2026/CVE-2026-126261.json index d0494ccde0..ce909ffe3d 100644 --- a/data/2026/CVE-2026-126261.json +++ b/data/2026/CVE-2026-126261.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.8","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets."}],"id":"CVE-2026-126261","lastModified":"2026-11-13T14:17:54.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126261","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:33:51.018334Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:20.897","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.8","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets."}],"id":"CVE-2026-126261","lastModified":"2026-11-14T05:18:39.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126261","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T23:17:20.897","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126852.json b/data/2026/CVE-2026-126852.json index 29f4a3044c..1425d0e5ab 100644 --- a/data/2026/CVE-2026-126852.json +++ b/data/2026/CVE-2026-126852.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126852","lastModified":"2026-11-12T17:17:34.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:51.437745Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.200","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580846651"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126852","lastModified":"2026-11-14T05:18:39.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.200","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580846651"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126881.json b/data/2026/CVE-2026-126881.json index 1bc2444d29..08fd21cbc0 100644 --- a/data/2026/CVE-2026-126881.json +++ b/data/2026/CVE-2026-126881.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126881","lastModified":"2026-11-12T19:49:24.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126881","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:12.531354Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.137","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575038730"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126881","lastModified":"2026-11-14T05:18:39.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126881","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.137","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575038730"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-55335.json b/data/2026/CVE-2026-55335.json index ddd8ac1051..bb9d0636f8 100644 --- a/data/2026/CVE-2026-55335.json +++ b/data/2026/CVE-2026-55335.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55335","lastModified":"2026-11-13T16:19:03.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55335","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:44:48.151839Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.430","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55335","lastModified":"2026-11-14T05:18:40.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55335","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.430","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-56916.json b/data/2026/CVE-2026-56916.json index c896a67003..8823dda5e8 100644 --- a/data/2026/CVE-2026-56916.json +++ b/data/2026/CVE-2026-56916.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56916","lastModified":"2026-11-13T15:17:51.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:53:32.195635Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.233","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56916","lastModified":"2026-11-14T05:18:40.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.233","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-61418.json b/data/2026/CVE-2026-61418.json index 82fcd2e064..c0925ccef0 100644 --- a/data/2026/CVE-2026-61418.json +++ b/data/2026/CVE-2026-61418.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution."}],"id":"CVE-2026-61418","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.880","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution."}],"id":"CVE-2026-61418","lastModified":"2026-11-14T05:18:40.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T10:18:15.880","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76981.json b/data/2026/CVE-2026-76981.json index 0b13fb9210..45c78f7578 100644 --- a/data/2026/CVE-2026-76981.json +++ b/data/2026/CVE-2026-76981.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8711","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module."}],"id":"CVE-2026-76981","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-11T08:17:18.760","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8711","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module."}],"id":"CVE-2026-76981","lastModified":"2026-11-14T05:18:41.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76981","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T08:17:18.760","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82177.json b/data/2026/CVE-2026-82177.json index 0f8812ebc4..e7da62bc47 100644 --- a/data/2026/CVE-2026-82177.json +++ b/data/2026/CVE-2026-82177.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-13T17:17:35.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:05:12.337571Z","version":"2.0.3"}}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-14T05:18:41.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-86355.json b/data/2026/CVE-2026-86355.json index fe502f9ba1..910e2a74e6 100644 --- a/data/2026/CVE-2026-86355.json +++ b/data/2026/CVE-2026-86355.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance."}],"id":"CVE-2026-86355","lastModified":"2026-11-13T16:19:35.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86355","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:41.902083Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:29.887","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security_alert@emc.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance."}],"id":"CVE-2026-86355","lastModified":"2026-11-14T05:18:41.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86355","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T13:18:29.887","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-86356.json b/data/2026/CVE-2026-86356.json index 837917477f..15588fde4e 100644 --- a/data/2026/CVE-2026-86356.json +++ b/data/2026/CVE-2026-86356.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator."}],"id":"CVE-2026-86356","lastModified":"2026-11-13T16:19:36.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:51:06.375031Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:30.020","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator."}],"id":"CVE-2026-86356","lastModified":"2026-11-14T05:18:41.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-13T13:18:30.020","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91879.json b/data/2026/CVE-2026-91879.json index 61ad3f623e..63ff163095 100644 --- a/data/2026/CVE-2026-91879.json +++ b/data/2026/CVE-2026-91879.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for ObjectScale","vendor":"Dell","versions":[{"lessThan":"1.1.1 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Terraform Provider for PowerStore","vendor":"Dell","versions":[{"lessThan":"1.3.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91879","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for ObjectScale","vendor":"Dell","versions":[{"lessThan":"1.1.1 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Terraform Provider for PowerStore","vendor":"Dell","versions":[{"lessThan":"1.3.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91879","lastModified":"2026-11-14T05:18:41.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91879","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T18:19:53.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/state/sync.json b/state/sync.json index 5381e5970d..3f3aa4b7ea 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1 +1 @@ -{"initial_complete":true,"last_run_counts":{"seen":3770,"skipped":0,"unchanged":3699,"written":71},"last_run_mode":"incremental","last_successful_end":"2026-11-14T04:42:52+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-14T04:48:07.903288+00:00"} +{"initial_complete":true,"last_run_counts":{"seen":3768,"skipped":0,"unchanged":3685,"written":83},"last_run_mode":"incremental","last_successful_end":"2026-11-14T06:42:52+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-14T06:48:22.221877+00:00"}