{"resultsPerPage":453,"startIndex":0,"totalResults":453,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-02T18:10:05.310","vulnerabilities":[{"cve":{"id":"CVE-2023-36464","sourceIdentifier":"security-advisories@github.com","published":"2023-06-27T22:15:11.790","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b\"\\r\", b\"\\n\")` in `pypdf/generic/_data_structures.py` to `while peek not in (b\"\\r\", b\"\\n\", b\"\")`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":" pypdf: < 3.90","status":"affected"},{"version":"PyPDF2: >= 2.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-12-03T16:55:56.361143Z","id":"CVE-2023-36464","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"3.9.0","matchCriteriaId":"6EE5EE7F-A081-447C-8A71-F943822D3FF2"},{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf2_project:pypdf2:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","matchCriteriaId":"DD9934DB-5ADB-4BD1-B3E8-2C06CCF199D6"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/1828","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/969","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8","source":"security-advisories@github.com","tags":["Exploit","Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/1828","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/969","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"]}]}},{"cve":{"id":"CVE-2023-36807","sourceIdentifier":"security-advisories@github.com","published":"2023-06-30T19:15:09.283","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF. Versions prior to 2.10.5 throw an error, but do not hang forever. This issue was fixed with https://github.com/py-pdf/pypdf/pull/1331 which has been included in release 2.10.6. Users are advised to upgrade. Users unable to upgrade should modify `PyPDF2/generic/_data_structures.py::read_object` to an an error throwing case. See GHSA-hm9v-vj3r-r55m for details. "}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"2.10.5","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"pypdf_project","product":"pypdf","defaultStatus":"unknown","cpes":["cpe:2.3:a:pypdf_project:pypdf:2.10.5:*:*:*:*:*:*:*"],"versions":[{"version":"2.10.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-06T19:51:03.876776Z","id":"CVE-2023-36807","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:2.10.5:*:*:*:*:*:*:*","matchCriteriaId":"2F161F74-5FDB-4AB8-8F24-E52A19F10694"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/issues/1329","source":"security-advisories@github.com","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/pull/1331","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55m","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Patch","Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/issues/1329","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/pull/1331","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-hm9v-vj3r-r55m","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mitigation","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2023-36810","sourceIdentifier":"security-advisories@github.com","published":"2023-06-30T19:15:09.357","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 1.27.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-04T21:19:20.245358Z","id":"CVE-2023-36810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndIncluding":"1.27.8","matchCriteriaId":"658E15A0-BCB5-4045-BA93-396B38DFA6E5"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/issues/582","source":"security-advisories@github.com","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/pull/808","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/issues/582","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/pull/808","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2023-46250","sourceIdentifier":"security-advisories@github.com","published":"2023-10-31T16:15:09.930","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions 3.7.0 through 3.16.4 can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case when the pypdf-user manipulates an incoming malicious PDF e.g. by merging it with another PDF or by adding annotations. The issue was fixed in version 3.17.0. As a workaround, apply the patch manually by modifying `pypdf/generic/_data_structures.py`."},{"lang":"es","value":"pypdf es una librería de PDF pura de Python gratuita y de código abierto. Un atacante que utilice una vulnerabilidad presente en las versiones 3.7.0 a 3.16.4 puede crear un PDF que genere un bucle infinito. Este bucle infinito bloquea el proceso actual y puede utilizar un solo núcleo de la CPU al 100%. No afecta el uso de la memoria. Ese es, por ejemplo, el caso cuando el usuario de pypdf manipula un PDF malicioso entrante, por ejemplo fusionándolo con otro PDF o agregando anotaciones. El problema se solucionó en la versión 3.17.0. Como workaround, aplique el parche manualmente modificando `pypdf/generic/_data_structures.py`."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":">= 3.7.0, < 3.17.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-05T18:52:16.129180Z","id":"CVE-2023-46250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7.0","versionEndExcluding":"3.17.0","matchCriteriaId":"34F9160C-1FD3-4F8E-8A6E-76793E8824EA"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/2264","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63f","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/commit/9b23ac3c9619492570011d551d521690de9a3e2d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/2264","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjcc-cq79-p63f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-55197","sourceIdentifier":"security-advisories@github.com","published":"2025-08-13T23:15:27.660","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file."},{"lang":"es","value":"Pypdf es una librería PDF gratuita y de código abierto basada en Python. Antes de la versión 6.0.0, un atacante podía manipular un PDF que agotaba la RAM. Esto solo requería leer el archivo si se utilizaban una serie de filtros FlateDecode en un flujo de referencia cruzada malicioso. Otros flujos de contenido se ven afectados con el acceso explícito. Este problema se ha corregido en la versión 6.0.0. Si no es posible actualizar, una solución alternativa consiste en incluir el código corregido de pypdf.filters.decompress en el archivo de filtros existente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-14T13:41:25.204585Z","id":"CVE-2025-55197","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0","matchCriteriaId":"5CB95B04-13DB-4305-9175-CB4E2C01EA1C"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/py-pdf/pypdf/issues/3429","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/pull/3430","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.0.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m","source":"security-advisories@github.com","tags":["Mitigation","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-62707","sourceIdentifier":"security-advisories@github.com","published":"2025-10-22T22:15:35.707","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.1.3, un atacante que utiliza esta vulnerabilidad puede crear un PDF que conduce a un bucle infinito. Esto requiere analizar el flujo de contenido de una página que tiene una imagen en línea utilizando el filtro DCTDecode. Esto ha sido corregido en la versión 6.1.3 de pypdf."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.1.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-23T15:41:24.281982Z","id":"CVE-2025-62707","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.3","matchCriteriaId":"60333A91-A6E8-469D-BB67-2662767EC603"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3501","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.1.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-62708","sourceIdentifier":"security-advisories@github.com","published":"2025-10-22T22:15:35.880","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.1.3, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca un gran uso de memoria. Esto requiere analizar el flujo de contenido de una página utilizando el filtro LZWDecode. Esto ha sido corregido en la versión 6.1.3 de pypdf."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.1.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-23T15:10:16.712325Z","id":"CVE-2025-62708","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-409"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.3","matchCriteriaId":"60333A91-A6E8-469D-BB67-2662767EC603"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3502","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.1.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jfx9-29x2-rv3j","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-63387","sourceIdentifier":"cve@mitre.org","published":"2025-12-18T19:16:33.157","lastModified":"2026-11-02T16:17:19.950","vulnStatus":"Modified","cveTags":[{"sourceIdentifier":"cve@mitre.org","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed."},{"lang":"es","value":"Dify v1.9.1 es vulnerable a Permisos Inseguros. Un atacante no autenticado puede enviar directamente solicitudes HTTP GET al endpoint /console/api/system-features sin ninguna credencial de autenticación o tokens de sesión. El endpoint no implementa controles de autorización adecuados, permitiendo el acceso anónimo a datos sensibles de configuración del sistema. NOTA: El mantenedor afirma que el endpoint no está autenticado por diseño y sirve como un mecanismo de arranque requerido para la inicialización del panel de control. También afirman que la descripción clasifica de forma imprecisa los datos devueltos como configuración sensible del sistema, afirmando que los datos no son sensibles y son requeridos para la renderización del lado del cliente. No se exponen PII, credenciales o secretos."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Dify","product":"Dify","defaultStatus":"unknown","modules":["/console/api/system-features"],"versions":[{"version":"1.9.1","versionType":"semver","status":"affected"},{"version":"1.17.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-19T17:32:01.989880Z","id":"CVE-2025-63387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Primary","description":[{"lang":"en","value":"CWE-669"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langgenius:dify:1.9.1:*:*:*:*:node.js:*:*","matchCriteriaId":"ABF9FC69-C390-446E-830C-5F8B0A0488F2"}]}]}],"references":[{"url":"https://gist.github.com/Cristliu/cddc0cbbf354de51106ab63a11be94af","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://gist.github.com/Cristliu/dfc5f3a31dc6d7fff2754867e5c649a5","source":"cve@mitre.org"},{"url":"https://github.com/langgenius/dify/discussions","source":"cve@mitre.org","tags":["Issue Tracking"]},{"url":"https://github.com/langgenius/dify/issues/31368#issuecomment-3783712203","source":"cve@mitre.org"},{"url":"https://github.com/langgenius/dify/pull/31392","source":"cve@mitre.org"},{"url":"https://github.com/langgenius/dify/pull/31417","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-22690","sourceIdentifier":"security-advisories@github.com","published":"2026-01-10T05:16:01.847","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.6.0, pypdf tiene posibles tiempos de ejecución largos para objetos /Root faltantes con valores /Size grandes. Un atacante que utiliza esta vulnerabilidad puede crear un PDF que conduce a posibles tiempos de ejecución largos para archivos realmente inválidos. Esto se puede lograr omitiendo la entrada /Root en el tráiler, mientras se utiliza un valor /Size bastante grande. Solo el modo de lectura no estricto se ve afectado. Este problema ha sido parcheado en la versión 6.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-12T17:06:53.596988Z","id":"CVE-2026-22690","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.0","matchCriteriaId":"B61C2E0D-84F8-4965-A23B-8316DBDCA190"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3594","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.6.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4xc4-762w-m6cg","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-22691","sourceIdentifier":"security-advisories@github.com","published":"2026-01-10T05:16:08.680","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.6.0, pypdf presenta posibles tiempos de ejecución prolongados para 'startxref' malformados. Un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca posibles tiempos de ejecución prolongados para entradas 'startxref' no válidas. Al reconstruir la tabla de referencias cruzadas, los archivos PDF con muchos caracteres de espacio en blanco se vuelven problemáticos. Solo el modo de lectura no estricto se ve afectado. Solo el modo de lectura no estricto se ve afectado. Este problema ha sido parcheado en la versión 6.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-12T16:48:45.352870Z","id":"CVE-2026-22691","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.0","matchCriteriaId":"B61C2E0D-84F8-4965-A23B-8316DBDCA190"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/294165726b646bb7799be1cc787f593f2fdbcf45","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3594","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.6.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4f6g-68pf-7vhv","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-24688","sourceIdentifier":"security-advisories@github.com","published":"2026-01-27T20:16:24.193","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually."},{"lang":"es","value":"pypdf es una librería PDF de Python puro, gratuita y de código abierto. Un atacante que utiliza una vulnerabilidad de bucle infinito presente en versiones anteriores a la 6.6.2 puede crear un PDF que conduce a un bucle infinito. Esto requiere acceder a los esquemas/marcadores. Esto ha sido corregido en pypdf 6.6.2. Si los proyectos aún no pueden actualizar, considere aplicar los cambios de la PR #3610 manualmente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.6.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-27T20:35:51.227753Z","id":"CVE-2026-24688","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.2","matchCriteriaId":"ECAD2F11-40F1-4F34-B275-3944F6760759"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/b1282f8dcdc1a7b41ceab6740ffddfdf31b1fec1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3610","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.6.2","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-2q4j-m29v-hq73","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-27024","sourceIdentifier":"security-advisories@github.com","published":"2026-02-20T22:16:28.687","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1."},{"lang":"es","value":"pypdf es una biblioteca PDF pure-python gratuita y de código abierto. Antes de la 6.7.1, un atacante que explota esta vulnerabilidad puede crear un PDF que provoca un bucle infinito. Esto requiere acceder a los hijos de un TreeObject, por ejemplo, como parte de los esquemas. Esta vulnerabilidad está corregida en la 6.7.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-24T18:34:14.751487Z","id":"CVE-2026-27024","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.1","matchCriteriaId":"DADB78CA-4929-42DE-A72C-DC885D75E080"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/bd2f6d052fe5941e85e37082c2a43453d48d1295","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3645","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-996q-pr4m-cvgq","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-27025","sourceIdentifier":"security-advisories@github.com","published":"2026-02-20T22:16:28.850","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1."},{"lang":"es","value":"pypdf es una biblioteca PDF escrita puramente en Python, gratuita y de código abierto. Antes de 6.7.1, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados y un gran consumo de memoria. Esto requiere el análisis de la entrada /ToUnicode de una fuente con valores inusualmente grandes, por ejemplo durante la extracción de texto. Esta vulnerabilidad está corregida en 6.7.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-24T18:39:43.799501Z","id":"CVE-2026-27025","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.1","matchCriteriaId":"DADB78CA-4929-42DE-A72C-DC885D75E080"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/77d7b8d7cfbe8dd179858dfa42666f73fc6e57a2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3646","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-wgvp-vg3v-2xq3","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-27026","sourceIdentifier":"security-advisories@github.com","published":"2026-02-20T22:16:29.023","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.7.1, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados. Esto requiere un flujo /FlateDecode malformado, donde se utiliza la descompresión byte a byte. Esta vulnerabilidad está corregida en la versión 6.7.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-24T18:46:44.502341Z","id":"CVE-2026-27026","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.1","matchCriteriaId":"DADB78CA-4929-42DE-A72C-DC885D75E080"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/7905842d833f899f1d3228af7e7467ad80277016","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3644","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mvc-8737-8j8h","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-27628","sourceIdentifier":"security-advisories@github.com","published":"2026-02-25T03:16:06.513","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually."},{"lang":"es","value":"pypdf es una librería PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.7.2, un atacante que utiliza esta vulnerabilidad puede crear un PDF que conduce a un bucle infinito. Esto requiere leer el archivo. Esto ha sido corregido en pypdf 6.7.2. Como solución alternativa, se puede aplicar el parche manualmente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-25T15:58:27.836793Z","id":"CVE-2026-27628","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.2","matchCriteriaId":"4FC12066-C983-4486-82BA-A96A118B47CC"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/f0a462d36971cf077d74492a348d0d06fd60ea4d","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/issues/3654","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-2rw7-x74f-jg35","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/py-pdf/pypdf/issues/3654","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Patch"]}]}},{"cve":{"id":"CVE-2026-27888","sourceIdentifier":"security-advisories@github.com","published":"2026-02-26T01:16:25.470","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.7.3, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca el agotamiento de la RAM. Esto requiere acceder a la propiedad 'xfa' de un lector o escritor y que el flujo correspondiente esté comprimido usando '/FlateDecode'. Esto ha sido corregido en pypdf 6.7.3. Como solución alternativa, aplique el parche manualmente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-26T16:15:44.619815Z","id":"CVE-2026-27888","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.3","matchCriteriaId":"AE6DBE3E-B51E-4B0A-90CE-B770434148E9"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/7a4c8246ed48d9d328fb596942271da47b6d109c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3658","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.3","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-x7hp-r3qg-r3cj","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28351","sourceIdentifier":"security-advisories@github.com","published":"2026-02-27T21:16:19.177","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664."},{"lang":"es","value":"pypdf es una librería PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.7.4, un atacante que utiliza esta vulnerabilidad puede crear un PDF que conduce a un gran uso de memoria. Esto requiere analizar el flujo de contenido utilizando el filtro RunLengthDecode. Esto ha sido corregido en pypdf 6.7.4. Como solución alternativa, considere aplicar los cambios de la PR #3664."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-03T20:28:37.910844Z","id":"CVE-2026-28351","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.4","matchCriteriaId":"938194EF-7C0C-49BF-933D-6EF2B5A96C44"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/f309c6003746414dc7b5048c19e6d879ff2dc858","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3664","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.4","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-f2v5-7jq9-h8cg","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28804","sourceIdentifier":"security-advisories@github.com","published":"2026-03-06T07:16:01.220","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5."},{"lang":"es","value":"pypdf es una librería PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.7.5, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados. Esto requiere acceder a un flujo que utiliza el filtro /ASCIIHexDecode. Este problema ha sido parcheado en la versión 6.7.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.7.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-06T15:59:59.320844Z","id":"CVE-2026-28804","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.5","matchCriteriaId":"12239194-68B0-42CA-B671-448A1C964BC4"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3666","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.7.5","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-31826","sourceIdentifier":"security-advisories@github.com","published":"2026-03-10T22:16:20.483","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0."},{"lang":"es","value":"pypdf es una biblioteca PDF pura de Python, gratuita y de código abierto. Antes de la 6.8.0, un atacante que explota esta vulnerabilidad puede crear un PDF que provoca un gran consumo de memoria. Esto requiere analizar una secuencia de contenido con un valor /Length bastante grande, independientemente de la longitud real de los datos dentro de la secuencia. Esta vulnerabilidad está corregida en la 6.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-11T15:51:55.234665Z","id":"CVE-2026-31826","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.8.0","matchCriteriaId":"0DBA2035-840D-4AE9-97BB-3AE6336005A7"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3675","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.8.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-hqmh-ppp3-xvm7","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-33123","sourceIdentifier":"security-advisories@github.com","published":"2026-03-20T10:16:18.717","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Las versiones anteriores a la 6.9.1 permiten a un atacante crear un PDF malicioso que provoca tiempos de ejecución prolongados y/o un gran uso de memoria. La explotación requiere acceder a un flujo basado en arrays con muchas entradas. Este problema ha sido solucionado en la versión 6.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-20T16:03:57.586173Z","id":"CVE-2026-33123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.1","matchCriteriaId":"5A2A7FB6-1BB4-41E1-A3B8-B63A706F529D"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3686","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.9.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-qpxp-75px-xjcp","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-33699","sourceIdentifier":"security-advisories@github.com","published":"2026-03-27T01:16:19.147","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually."},{"lang":"es","value":"pypdf es una biblioteca PDF escrita puramente en Python, gratuita y de código abierto. Las versiones anteriores a la 6.9.2 tienen una vulnerabilidad en la que un atacante puede crear un PDF que conduce a un bucle infinito. Esto requiere leer un archivo en modo no estricto. Esto ha sido corregido en pypdf 6.9.2. Si los usuarios aún no pueden actualizar, consideren aplicar los cambios del parche manualmente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.9.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-27T13:27:07.800115Z","id":"CVE-2026-33699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.2","matchCriteriaId":"01054FD1-B7B9-4EEB-B912-A812FA0F512D"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3693","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.9.2","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-40260","sourceIdentifier":"security-advisories@github.com","published":"2026-04-17T01:17:39.733","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.10.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-17T18:41:50.866889Z","id":"CVE-2026-40260","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-776"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.0","matchCriteriaId":"395EE0C8-4212-45CC-8895-1FB37C1C96FC"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3724","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.10.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41168","sourceIdentifier":"security-advisories@github.com","published":"2026-04-22T21:17:09.450","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.10.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-23T13:41:24.058142Z","id":"CVE-2026-41168","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.1","matchCriteriaId":"BEC3380E-92AC-4158-8C72-DD48BB8F77B3"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3733","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.10.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41312","sourceIdentifier":"security-advisories@github.com","published":"2026-04-22T22:16:32.093","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.10.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-23T13:45:18.970091Z","id":"CVE-2026-41312","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.2","matchCriteriaId":"E6FD6D60-9147-4408-A1C6-342FDBDD35FA"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3734","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.10.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41313","sourceIdentifier":"security-advisories@github.com","published":"2026-04-22T22:16:32.220","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.10.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-23T13:42:06.228654Z","id":"CVE-2026-41313","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.2","matchCriteriaId":"E6FD6D60-9147-4408-A1C6-342FDBDD35FA"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3735","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.10.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4pxv-j86v-mhcw","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41314","sourceIdentifier":"security-advisories@github.com","published":"2026-04-22T22:16:32.367","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.10.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-23T14:21:23.056055Z","id":"CVE-2026-41314","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.2","matchCriteriaId":"E6FD6D60-9147-4408-A1C6-342FDBDD35FA"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3734","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.10.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-48155","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T16:16:28.890","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.12.0, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca un gran uso de memoria. Esto requiere extraer texto en modo de diseño con grandes desplazamientos de caracteres. Esta vulnerabilidad está corregida en la versión 6.12.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.12.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-28T15:57:44.616233Z","id":"CVE-2026-48155","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.0","matchCriteriaId":"5A792F29-DA35-4067-BBB5-65D425AFA7AB"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3790","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-48156","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T16:16:29.020","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.12.0, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados. Esto requiere flujos de referencias cruzadas con valores /W [0 0 0] y valores /Size grandes. Esta vulnerabilidad está corregida en la versión 6.12.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.12.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-30T02:08:10.197722Z","id":"CVE-2026-48156","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.0","matchCriteriaId":"5A792F29-DA35-4067-BBB5-65D425AFA7AB"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3791","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-48735","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T16:16:29.787","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la 6.12.1, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca un gran consumo de memoria. Esto requiere el análisis de metadatos XMP grandes, posiblemente con muchos elementos innecesarios. Esta vulnerabilidad está corregida en la 6.12.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.12.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T14:56:55.997922Z","id":"CVE-2026-48735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.1","matchCriteriaId":"CD661E39-2609-46A9-B437-59CB31CC1F56"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3796","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49460","sourceIdentifier":"security-advisories@github.com","published":"2026-06-22T21:16:24.940","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la 6.12.2, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca tiempos de ejecución prolongados. Esto requiere acceder a un flujo que utiliza el filtro /FlateDecode con un predictor PNG. Esta vulnerabilidad está corregida en la 6.12.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-23T14:04:25.948226Z","id":"CVE-2026-49460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.2","matchCriteriaId":"4472347A-CA4E-4063-8386-9197611FFCE4"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3806","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49461","sourceIdentifier":"security-advisories@github.com","published":"2026-06-22T21:16:25.070","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.12.2, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca un gran consumo de memoria. Esto requiere extraer el texto de una página que contiene un XObject de formulario con autorreferencias. Esta vulnerabilidad está corregida en la versión 6.12.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-23T12:23:13.224222Z","id":"CVE-2026-49461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.2","matchCriteriaId":"4472347A-CA4E-4063-8386-9197611FFCE4"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3805","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.12.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-54530","sourceIdentifier":"security-advisories@github.com","published":"2026-06-22T21:16:25.420","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0."},{"lang":"es","value":"pypdf es una biblioteca PDF gratuita y de código abierto escrita íntegramente en Python. Antes de la versión 6.13.0, un atacante que utiliza esta vulnerabilidad puede crear un PDF que lleva a un bucle infinito. Esto requiere la extracción del texto en modo de diseño. Esta vulnerabilidad está corregida en la versión 6.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-23T14:52:35.536228Z","id":"CVE-2026-54530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.0","matchCriteriaId":"229122FE-955B-4724-87D3-2D93A0466CE2"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3830","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.13.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-52x6-gq3r-vpf4","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-54531","sourceIdentifier":"security-advisories@github.com","published":"2026-06-22T21:16:25.550","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.13.0, un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca un bucle infinito. Esto requiere fusionar un archivo con esquemas en un escritor. Esta vulnerabilidad está corregida en la versión 6.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-23T14:17:27.850481Z","id":"CVE-2026-54531","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.0","matchCriteriaId":"229122FE-955B-4724-87D3-2D93A0466CE2"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3830","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.13.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-54651","sourceIdentifier":"security-advisories@github.com","published":"2026-06-22T21:16:25.680","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.13.1, un atacante que explota esta vulnerabilidad puede crear un PDF que provoca un bucle infinito. Esto requiere fusionar un archivo con hilos/artículos en un escritor. Esta vulnerabilidad está corregida en la versión 6.13.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.13.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-23T12:09:57.316922Z","id":"CVE-2026-54651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.1","matchCriteriaId":"8981DD42-F2BF-431F-95CE-EC91F77C8121"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/pull/3839","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.13.1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57204","sourceIdentifier":"security-advisories@github.com","published":"2026-06-30T22:16:57.700","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.13.3, un PDF creado maliciosamente puede causar DoS. Un atacante que utiliza esta vulnerabilidad puede crear un PDF que provoca un gran uso de memoria, ya que MAX_DECLARED_STREAM_LENGTH a veces se ignora. Esto requiere analizar un flujo de contenido sin un valor /Length. Este problema ha sido solucionado en la versión 6.13.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.13.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-01T13:57:13.824803Z","id":"CVE-2026-57204","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.3","matchCriteriaId":"4A67E3D8-BE40-478A-A2AE-F01C4801AB62"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.13.3","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jm82-fx9c-mx94","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59937","sourceIdentifier":"security-advisories@github.com","published":"2026-07-08T18:16:34.963","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.14.0, un atacante puede crear un PDF con flujos de referencias cruzadas malformados y repetidos que hacen que pypdf emplee largos tiempos de ejecución para recuperar entradas de tablas de referencias cruzadas rotas. Este problema está solucionado en la versión 6.14.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.14.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-09T14:38:02.608932Z","id":"CVE-2026-59937","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14.0","matchCriteriaId":"F3127775-396D-45C6-9C41-EB2BD0841D64"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3887","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-55h5-xmcq-c37v","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59938","sourceIdentifier":"security-advisories@github.com","published":"2026-07-08T18:16:35.097","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large compared to the actual data, causing large memory usage in pypdf image parsing. This issue is fixed in version 6.14.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la 6.14.0, un atacante puede elaborar un PDF con valores de tamaño de imagen declarados que son demasiado grandes en comparación con los datos reales, provocando un alto consumo de memoria en el análisis de imágenes de pypdf. Este problema se soluciona en la versión 6.14.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.14.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-09T13:58:08.413307Z","id":"CVE-2026-59938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14.0","matchCriteriaId":"F3127775-396D-45C6-9C41-EB2BD0841D64"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3888","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5qjq-93h5-hrgp","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59935","sourceIdentifier":"security-advisories@github.com","published":"2026-07-08T20:16:59.260","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated inline image that uses the ASCII85 or ASCIIHex filters, causing an infinite loop during parsing such as when extracting page text. This issue is fixed in version 6.14.2."},{"lang":"es","value":"pypdf es una biblioteca PDF gratuita y de código abierto escrita íntegramente en Python. Antes de la versión 6.14.2, un atacante puede crear un PDF con un flujo de contenido de página que contenga una imagen en línea no terminada que utilice los filtros ASCII85 o ASCIIHex, lo que provoca un bucle infinito durante el análisis, como al extraer texto de la página. Este problema está solucionado en la versión 6.14.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.14.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-09T13:36:07.945731Z","id":"CVE-2026-59935","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14.2","matchCriteriaId":"25B7F0EE-585E-4AF0-9D27-1A30A0E814FC"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/5a33a46416aa1ae6c025ff90a3cca57631fdafd2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3892","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.2","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g867-7843-wf8q","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59936","sourceIdentifier":"security-advisories@github.com","published":"2026-07-08T20:16:59.403","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.14.1, un atacante puede crear un PDF con un flujo de contenido de página que contenga una imagen en línea no terminada, lo que provoca un bucle infinito durante la detección del marcador de fin de imagen en línea, como al extraer texto de la página. Este problema se solucionó en la versión 6.14.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.14.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-09T13:26:41.429218Z","id":"CVE-2026-59936","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14.1","matchCriteriaId":"B9BE0150-4743-4C9F-AF21-3448DC681CCC"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3891","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.14.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5xf7-4p34-54qr","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-12617","sourceIdentifier":"security-officer@isc.org","published":"2026-07-22T15:16:51.963","lastModified":"2026-11-02T16:28:17.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."},{"lang":"es","value":"El problema es la terminación inesperada del programa basada en el orden y/o el contenido específico en las respuestas a las consultas de registros CNAME o DNAME, y registros A. Específicamente, si un cliente consulta por un registro DNAME y un registro A por debajo del DNAME al resolvedor, y el servidor autoritativo responde positivamente a la consulta A pero retrasa la respuesta DNAME y luego responde negativamente, ’named’ puede cerrarse inesperadamente. O, si un cliente consulta por un registro CNAME y un registro A para el mismo nombre al resolvedor, y el servidor autoritativo responde positivamente a la consulta A pero retrasa la respuesta CNAME y luego responde con un CNAME autorreferencial, la misma falla puede ocurrir.\nEste problema afecta a las versiones de BIND 9 9.18.0 a 9.18.50, 9.20.0 a 9.20.24, 9.18.11-S1 a 9.18.50-S1, y 9.20.9-S1 a 9.20.24-S1."}],"affected":[{"source":"security-officer@isc.org","affectedData":[{"vendor":"ISC","product":"BIND 9","defaultStatus":"unaffected","versions":[{"version":"9.18.0","lessThanOrEqual":"9.18.50","versionType":"custom","status":"affected"},{"version":"9.20.0","lessThanOrEqual":"9.20.24","versionType":"custom","status":"affected"},{"version":"9.18.11-S1","lessThanOrEqual":"9.18.50-S1","versionType":"custom","status":"affected"},{"version":"9.20.9-S1","lessThanOrEqual":"9.20.24-S1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-officer@isc.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-22T18:48:06.430818Z","id":"CVE-2026-12617","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-officer@isc.org","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*","versionStartIncluding":"9.18.0","versionEndIncluding":"9.18.50","matchCriteriaId":"F311703A-5945-4295-A036-5D878F136343"},{"vulnerable":true,"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*","versionStartIncluding":"9.18.11","versionEndIncluding":"9.18.50","matchCriteriaId":"F1177F3C-7BE7-4ECA-8EAB-80B3C9EF77B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*","versionStartIncluding":"9.20.0","versionEndIncluding":"9.20.24","matchCriteriaId":"080D7F98-9784-4586-8ADA-CAAA0A9EC180"},{"vulnerable":true,"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*","versionStartIncluding":"9.20.9","versionEndIncluding":"9.20.24","matchCriteriaId":"AA853047-029C-4BC6-9C8C-10B183B9FB9E"}]}]}],"references":[{"url":"https://downloads.isc.org/isc/bind9/9.20.26","source":"security-officer@isc.org","tags":["Product"]},{"url":"https://kb.isc.org/docs/cve-2026-12617","source":"security-officer@isc.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71852","sourceIdentifier":"security-advisories@github.com","published":"2026-08-07T19:18:54.547","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0."},{"lang":"es","value":"pypdf es una biblioteca PDF de Python puro, gratuita y de código abierto. Antes de la versión 6.15.0, un PDF manipulado puede causar tiempos de ejecución prolongados y un gran consumo de memoria cuando la función Font._collect_cid_character_widths de pypdf/_font.py expande rangos de ancho /W de fuentes CID inusualmente grandes o entradas de ancho excesivas durante la extracción de texto. Este problema se ha solucionado en la versión 6.15.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.15.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-10T12:03:37.229178Z","id":"CVE-2026-71852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15.0","matchCriteriaId":"1AB8CD41-FC65-43C7-A679-AC2250461FA7"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3946","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.15.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71870","sourceIdentifier":"security-advisories@github.com","published":"2026-08-07T20:16:52.873","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0."},{"lang":"es","value":"pypdf es una biblioteca PDF gratuita y de código abierto escrita íntegramente en Python. Antes de la versión 6.15.0, un PDF manipulado puede causar un consumo elevado de memoria cuando la función parse_bfrange de pypdf/_cmap.py analiza tokens de código fuente o de cadena de destino inusualmente grandes en un CMap /ToUnicode de una fuente durante la extracción de texto. Este problema está solucionado en la versión 6.15.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.15.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-10T12:04:06.963067Z","id":"CVE-2026-71870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15.0","matchCriteriaId":"1AB8CD41-FC65-43C7-A679-AC2250461FA7"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3944","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.15.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20755","sourceIdentifier":"secure@intel.com","published":"2026-08-11T17:17:51.570","lastModified":"2026-11-02T15:30:44.903","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"affected":[{"source":"secure@intel.com","affectedData":[{"vendor":"n/a","product":"LLM Scaler software","defaultStatus":"unaffected","versions":[{"version":"See references","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"secure@intel.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-12T15:47:20.476217Z","id":"CVE-2026-20755","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@intel.com","type":"Primary","description":[{"lang":"en","value":"CWE-693"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:intel:llm-scaler-vllm:1.0:*:*:*:*:docker:*:*","matchCriteriaId":"548654D1-3E22-4D5D-8472-A54DF7B685CC"}]}]}],"references":[{"url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01466.html","source":"secure@intel.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82398","sourceIdentifier":"security-advisories@github.com","published":"2026-08-31T22:17:23.083","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.15.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-01T14:18:26.492095Z","id":"CVE-2026-82398","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15.0","matchCriteriaId":"1AB8CD41-FC65-43C7-A679-AC2250461FA7"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3947","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.15.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84309","sourceIdentifier":"security-advisories@github.com","published":"2026-09-01T20:17:25.027","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop. This issue is fixed in version 6.16.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.16.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-02T13:39:41.162522Z","id":"CVE-2026-84309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.0","matchCriteriaId":"4906E462-A0C8-4F46-982B-15709AA4DB61"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3964","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.16.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84310","sourceIdentifier":"security-advisories@github.com","published":"2026-09-01T21:18:46.740","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-04T02:07:38.724444Z","id":"CVE-2026-84310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-405"},{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.1","matchCriteriaId":"88E870A7-AD25-4D31-B333-1C661D22E0B7"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3966","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.16.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84311","sourceIdentifier":"security-advisories@github.com","published":"2026-09-01T21:18:46.887","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-02T13:42:21.690154Z","id":"CVE-2026-84311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.1","matchCriteriaId":"88E870A7-AD25-4D31-B333-1C661D22E0B7"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/3966","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.16.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81665","sourceIdentifier":"secalert@redhat.com","published":"2026-09-04T09:17:11.357","lastModified":"2026-11-02T16:17:44.457","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:3.1.10-1.el10_2.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"versions":[{"version":"0:3.1.9-1.el10_0.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/o:redhat:enterprise_linux:7::server"],"versions":[{"version":"0:2.4.5-7.el7_9.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/a:redhat:enterprise_linux:8::highavailability","cpe:/a:redhat:enterprise_linux:8::resilientstorage"],"versions":[{"version":"0:3.1.8-1.el8_10.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::resilientstorage"],"versions":[{"version":"0:3.1.0-3.el8_4.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_aus:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.4::resilientstorage"],"versions":[{"version":"0:3.1.0-3.el8_4.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.6::resilientstorage"],"versions":[{"version":"0:3.1.5-2.el8_6.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::highavailability","cpe:/a:redhat:rhel_eus_long_life:8.6::resilientstorage"],"versions":[{"version":"0:3.1.5-2.el8_6.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_e4s:8.8::highavailability","cpe:/a:redhat:rhel_tus:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::highavailability"],"versions":[{"version":"0:3.1.7-1.el8_8.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_e4s:8.8::highavailability","cpe:/a:redhat:rhel_tus:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::highavailability"],"versions":[{"version":"0:3.1.7-1.el8_8.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/a:redhat:enterprise_linux:9::highavailability","cpe:/a:redhat:enterprise_linux:9::resilientstorage"],"versions":[{"version":"0:3.1.10-1.el9_8.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream","cpe:/a:redhat:rhel_e4s:9.2::highavailability","cpe:/a:redhat:rhel_e4s:9.2::resilientstorage"],"versions":[{"version":"0:3.1.7-1.el9_2.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream","cpe:/a:redhat:rhel_e4s:9.4::highavailability","cpe:/a:redhat:rhel_e4s:9.4::resilientstorage"],"versions":[{"version":"0:3.1.8-1.el9_4.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"corosync","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/a:redhat:rhel_eus:9.6::crb","cpe:/a:redhat:rhel_eus:9.6::highavailability","cpe:/a:redhat:rhel_eus:9.6::resilientstorage"],"versions":[{"version":"0:3.1.9-2.el9_6.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhcos","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhcos","cpes":["cpe:/a:redhat:openshift:5"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-04T17:09:13.395902Z","id":"CVE-2026-81665","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:67872","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67873","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67878","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67879","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67880","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67881","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68574","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69277","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69278","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69279","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69280","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81665","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524910","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-102993","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:27.630","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.17.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:31:55.843886Z","id":"CVE-2026-102993","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.0","matchCriteriaId":"96DC88C6-816D-4B20-A446-B56568EEAB39"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4047","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.17.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102994","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:28.080","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:50:09.677694Z","id":"CVE-2026-102994","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.0","matchCriteriaId":"C578CFF3-EE2E-432A-AB68-B59C14ABE3D6"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/82501d2993c6387833c4949d205caeb188f8bb9e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4055","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102995","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:06.713","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:50:23.022437Z","id":"CVE-2026-102995","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.1","matchCriteriaId":"E10BA883-AC67-451F-9D12-FEF68553B277"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/319d0b823ce2c311a2435e9fd93c13994d32bb51","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4071","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3h-c4fm-7vvf","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102996","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:06.863","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:48:29.732492Z","id":"CVE-2026-102996","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.1","matchCriteriaId":"E10BA883-AC67-451F-9D12-FEF68553B277"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4072","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102997","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.020","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:33:22.595789Z","id":"CVE-2026-102997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.1","matchCriteriaId":"E10BA883-AC67-451F-9D12-FEF68553B277"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/d9d38cf99b115deb562d3b68f36c33027bc04f79","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4073","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jw7q-gvrg-4vj3","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102998","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.177","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:49:24.715485Z","id":"CVE-2026-102998","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.0","matchCriteriaId":"DB6B11A0-D608-44B8-AE9E-098E9CBD02C4"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/959467a9b95be83e2dc5ae873ece5f371263ede7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4087","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-php9-fj8v-98fj","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102999","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.343","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:51:12.395176Z","id":"CVE-2026-102999","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.0","matchCriteriaId":"DB6B11A0-D608-44B8-AE9E-098E9CBD02C4"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4081","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcj","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103000","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.490","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:49:14.062135Z","id":"CVE-2026-103000","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.0","matchCriteriaId":"DB6B11A0-D608-44B8-AE9E-098E9CBD02C4"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/0d8b5a8832cde1ba308b5c27567b879b7b7eed4a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4096","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-w23x-9jrw-r45c","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91283","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:29.737","lastModified":"2026-11-02T16:31:51.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T19:54:43.228033Z","id":"CVE-2026-91283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91284","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:29.853","lastModified":"2026-11-02T16:31:27.040","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T19:55:29.333967Z","id":"CVE-2026-91284","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91286","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.083","lastModified":"2026-11-02T16:21:14.220","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T19:57:20.162286Z","id":"CVE-2026-91286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91287","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.200","lastModified":"2026-11-02T16:17:13.680","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T19:58:25.127109Z","id":"CVE-2026-91287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91288","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.310","lastModified":"2026-11-02T15:54:25.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T19:59:28.350867Z","id":"CVE-2026-91288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91289","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.420","lastModified":"2026-11-02T15:54:03.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T20:00:25.404866Z","id":"CVE-2026-91289","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91290","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.530","lastModified":"2026-11-02T15:53:42.560","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T20:01:20.521870Z","id":"CVE-2026-91290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91291","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.640","lastModified":"2026-11-02T15:53:10.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T20:02:00.711256Z","id":"CVE-2026-91291","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91293","sourceIdentifier":"secalert_us@oracle.com","published":"2026-10-20T22:20:30.870","lastModified":"2026-11-02T15:52:42.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)."}],"affected":[{"source":"secalert_us@oracle.com","affectedData":[{"vendor":"Oracle Corporation","product":"JD Edwards EnterpriseOne Tools","versions":[{"version":"9.2.0.0","lessThanOrEqual":"9.2.26.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert_us@oracle.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T19:35:08.830599Z","id":"CVE-2026-91293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0.0","versionEndIncluding":"9.2.26.5","matchCriteriaId":"597B5C3C-AC21-4ADB-BF85-334270321AF2"}]}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-113789","sourceIdentifier":"security-advisories@github.com","published":"2026-10-21T16:17:26.603","lastModified":"2026-11-02T16:12:15.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T16:42:20.604011Z","id":"CVE-2026-113789","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:python:*:*","versionEndExcluding":"6.21.0","matchCriteriaId":"45D459FA-67C3-43B9-814F-D69F49AC7F0B"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/5ef728f0e16d225c853e89f861ba0a67402fe3f2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4219","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-113794","sourceIdentifier":"security-advisories@github.com","published":"2026-10-21T16:17:28.707","lastModified":"2026-11-02T16:12:51.503","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.20.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T01:20:32.593442Z","id":"CVE-2026-113794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:python:*:*","versionEndExcluding":"6.20.0","matchCriteriaId":"D8C3B104-009F-4D58-A016-D0B41781D934"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/issues/4169","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4170","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.20.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-113795","sourceIdentifier":"security-advisories@github.com","published":"2026-10-21T16:17:28.850","lastModified":"2026-11-02T16:13:25.763","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.20.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:58:24.825765Z","id":"CVE-2026-113795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:python:*:*","versionEndExcluding":"6.20.0","matchCriteriaId":"D8C3B104-009F-4D58-A016-D0B41781D934"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4173","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.20.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-114719","sourceIdentifier":"cve@mitre.org","published":"2026-10-22T02:16:59.570","lastModified":"2026-11-02T16:17:27.890","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Roundcube","product":"Webmail","defaultStatus":"unaffected","repo":"https://github.com/roundcube/roundcubemail/","versions":[{"version":"1.6.0","lessThan":"1.6.20","versionType":"semver","status":"affected"},{"version":"1.7.0","lessThan":"1.7.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:54:31.826562Z","id":"CVE-2026-114719","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionStartIncluding":"1.6.0","versionEndExcluding":"1.6.20","matchCriteriaId":"D91A1C10-A81F-420B-9DE2-078A9BBA469D"},{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionStartIncluding":"1.7.0","versionEndExcluding":"1.7.5","matchCriteriaId":"D41F4166-D4C5-4D1C-94AC-3CF3C27F1319"}]}]}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/6ea2bbe356099c9da98eabcfeafd8d6aa2d67b3d","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-114723","sourceIdentifier":"cve@mitre.org","published":"2026-10-22T02:17:00.190","lastModified":"2026-11-02T16:17:28.057","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Roundcube","product":"Webmail","defaultStatus":"unaffected","platforms":["Linux","MacOS"],"repo":"https://github.com/roundcube/roundcubemail/","versions":[{"version":"1.6.0","lessThan":"1.6.20","versionType":"semver","status":"affected"},{"version":"1.7.0","lessThan":"1.7.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:19:04.340702Z","id":"CVE-2026-114723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org"},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-114727","sourceIdentifier":"cve@mitre.org","published":"2026-10-22T02:17:00.797","lastModified":"2026-11-02T16:17:28.270","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Roundcube","product":"Webmail","defaultStatus":"unaffected","repo":"https://github.com/roundcube/roundcubemail/","versions":[{"version":"1.6.0","lessThan":"1.6.20","versionType":"semver","status":"affected"},{"version":"1.7.0","lessThan":"1.7.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:56:52.664557Z","id":"CVE-2026-114727","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionStartIncluding":"1.6.0","versionEndExcluding":"1.6.20","matchCriteriaId":"D91A1C10-A81F-420B-9DE2-078A9BBA469D"},{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionStartIncluding":"1.7.0","versionEndExcluding":"1.7.5","matchCriteriaId":"D41F4166-D4C5-4D1C-94AC-3CF3C27F1319"}]}]}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-114731","sourceIdentifier":"cve@mitre.org","published":"2026-10-22T03:16:38.363","lastModified":"2026-11-02T16:17:28.430","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Roundcube","product":"Webmail","defaultStatus":"unaffected","repo":"https://github.com/roundcube/roundcubemail/","versions":[{"version":"1.6.0","lessThan":"1.6.20","versionType":"semver","status":"affected"},{"version":"1.7.0","lessThan":"1.7.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:58:44.079182Z","id":"CVE-2026-114731","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/2c9f6da692fa37cad2aaf85d5b127b583d22b264","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org"},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-63243","sourceIdentifier":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","published":"2026-10-23T07:16:38.563","lastModified":"2026-11-02T16:17:42.407","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An\nauthentication vulnerability in the Bluetooth Low Energy (BLE) implementation\nof Creative Sound Blaster Katana could allow an attacker within Bluetooth range\nto connect to an affected device without prior pairing or authentication."}],"affected":[{"source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","affectedData":[{"vendor":"Creative Labs","product":"Creative Sound Blaster Katana V2, V2X, SE","defaultStatus":"unaffected","versions":[{"version":"1.30.260813.1100","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:09:19.901767Z","id":"CVE-2026-63243","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-134/","source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"}]}},{"cve":{"id":"CVE-2026-63244","sourceIdentifier":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","published":"2026-10-23T08:16:55.320","lastModified":"2026-11-02T16:17:42.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An authentication\nbypass vulnerability in WizLearn Technologies' Learning Management System (LMS)\ncould allow an unauthenticated remote attacker to bypass password\nauthentication and the OAuth authentication flow by sending a specially crafted\nPOST request, potentially resulting in unauthorised access to user accounts and\nfull administrative control of the LMS platform."}],"affected":[{"source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","affectedData":[{"vendor":"WizLearn Technologies Pte. Ltd.","product":"Learning Management System","defaultStatus":"unaffected","versions":[{"version":"N.A","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:15:48.579793Z","id":"CVE-2026-63244","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-155","source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"}]}},{"cve":{"id":"CVE-2026-107685","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-10-23T12:18:06.410","lastModified":"2026-11-02T16:17:26.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.\n\nThe OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.\n\nThis issue affects req_llm: from 1.9.0 before 1.29.0."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"agentjido","product":"req_llm","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"req_llm","cpes":["cpe:2.3:a:agentjido:req_llm:*:*:*:*:*:*:*:*"],"modules":["'Elixir.ReqLLM.Streaming.WebSocketSession.Client'","'Elixir.ReqLLM.Streaming.WebSocketSession'","'Elixir.ReqLLM.Providers.OpenAI.WebSocket'","'Elixir.ReqLLM.OpenAI.Realtime'","'Elixir.ReqLLM.Providers.OpenAICodex'"],"programFiles":["lib/req_llm/streaming/web_socket_session/client.ex","lib/req_llm/streaming/web_socket_session.ex","lib/req_llm/providers/openai/web_socket.ex","lib/req_llm/openai/realtime.ex","lib/req_llm/providers/openai_codex.ex"],"programRoutines":[{"name":"'Elixir.ReqLLM.Streaming.WebSocketSession.Client':start/3"},{"name":"'Elixir.ReqLLM.Streaming.WebSocketSession':start_link/2"},{"name":"'Elixir.ReqLLM.Streaming.WebSocketSession':init/1"},{"name":"'Elixir.ReqLLM.Providers.OpenAI.WebSocket':start_responses_session/2"},{"name":"'Elixir.ReqLLM.OpenAI.Realtime':connect/2"},{"name":"'Elixir.ReqLLM.Providers.OpenAICodex':start_responses_session/2"}],"repo":"https://github.com/agentjido/req_llm","packageURL":"pkg:hex/req_llm","versions":[{"version":"1.9.0","lessThan":"1.29.0","versionType":"semver","status":"affected"}]},{"vendor":"agentjido","product":"req_llm","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"agentjido/req_llm","cpes":["cpe:2.3:a:agentjido:req_llm:*:*:*:*:*:*:*:*"],"modules":["'Elixir.ReqLLM.Streaming.WebSocketSession.Client'","'Elixir.ReqLLM.Streaming.WebSocketSession'","'Elixir.ReqLLM.Providers.OpenAI.WebSocket'","'Elixir.ReqLLM.OpenAI.Realtime'","'Elixir.ReqLLM.Providers.OpenAICodex'"],"programFiles":["lib/req_llm/streaming/web_socket_session/client.ex","lib/req_llm/streaming/web_socket_session.ex","lib/req_llm/providers/openai/web_socket.ex","lib/req_llm/openai/realtime.ex","lib/req_llm/providers/openai_codex.ex"],"programRoutines":[{"name":"'Elixir.ReqLLM.Streaming.WebSocketSession.Client':start/3"},{"name":"'Elixir.ReqLLM.Streaming.WebSocketSession':start_link/2"},{"name":"'Elixir.ReqLLM.Streaming.WebSocketSession':init/1"},{"name":"'Elixir.ReqLLM.Providers.OpenAI.WebSocket':start_responses_session/2"},{"name":"'Elixir.ReqLLM.OpenAI.Realtime':connect/2"},{"name":"'Elixir.ReqLLM.Providers.OpenAICodex':start_responses_session/2"}],"repo":"https://github.com/agentjido/req_llm","packageURL":"pkg:github/agentjido/req_llm","versions":[{"version":"a389d718640ceb2d541a8f540ab954cbf5ef8313","lessThan":"c7264fc0217fbacfb5562234ff790b8e4462de76","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:22:34.733406Z","id":"CVE-2026-107685","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-107685.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/agentjido/req_llm/commit/a389d718640ceb2d541a8f540ab954cbf5ef8313","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/agentjido/req_llm/commit/c7264fc0217fbacfb5562234ff790b8e4462de76","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-107685","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95620","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-10-23T12:18:20.080","lastModified":"2026-11-02T16:17:45.370","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtbase"],"versions":[{"version":"0","lessThan":"6.9.0","versionType":"python","status":"unknown"},{"version":"6.9.0","lessThan":"6.11.3","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"GREEN"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:19:20.519620Z","id":"CVE-2026-95620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/759717","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-95620:","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-115785","sourceIdentifier":"cve@rapid7.com","published":"2026-10-23T14:17:52.750","lastModified":"2026-11-02T16:29:53.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"10.1.20","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-24T03:55:31.920337Z","id":"CVE-2026-115785","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"10.1.20","matchCriteriaId":"75EFB8C7-90C8-4600-8988-D9FA335DF38E"}]}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/","source":"cve@rapid7.com","tags":["Not Applicable"]}]}},{"cve":{"id":"CVE-2026-115786","sourceIdentifier":"cve@rapid7.com","published":"2026-10-23T14:17:52.867","lastModified":"2026-11-02T16:27:09.647","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"10.1.20","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:49:33.866375Z","id":"CVE-2026-115786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-682"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"10.1.20","matchCriteriaId":"75EFB8C7-90C8-4600-8988-D9FA335DF38E"}]}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/","source":"cve@rapid7.com","tags":["Not Applicable"]}]}},{"cve":{"id":"CVE-2026-50053","sourceIdentifier":"cve@rapid7.com","published":"2026-10-23T14:17:53.060","lastModified":"2026-11-02T16:07:36.880","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Zimbra","product":"Zimbra Collaboration Suite","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"10.1.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-28T17:53:40.070565Z","id":"CVE-2026-50053","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-642"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"10.1.17","matchCriteriaId":"CED568B6-824F-48AB-A518-EA79A1610341"}]}]}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cve@rapid7.com","tags":["Vendor Advisory"]},{"url":"https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/","source":"cve@rapid7.com","tags":["Not Applicable"]}]}},{"cve":{"id":"CVE-2026-102786","sourceIdentifier":"security@joomla.org","published":"2026-10-23T15:17:22.807","lastModified":"2026-11-02T16:17:22.560","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5"}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"phoca.cz","product":"Phoca Gallery extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"4.5.0-6.1.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:26:33.686181Z","id":"CVE-2026-102786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.phoca.cz/","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-105481","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:19.250","lastModified":"2026-11-02T16:17:23.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"22.23.3","lessThanOrEqual":"22.23.3","versionType":"semver","status":"affected"},{"version":"24.22.0","lessThanOrEqual":"24.22.0","versionType":"semver","status":"affected"},{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:54:30.945686Z","id":"CVE-2026-105481","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-105482","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:19.427","lastModified":"2026-11-02T16:17:23.480","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"22.23.3","lessThanOrEqual":"22.23.3","versionType":"semver","status":"affected"},{"version":"24.22.0","lessThanOrEqual":"24.22.0","versionType":"semver","status":"affected"},{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:51:33.530802Z","id":"CVE-2026-105482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-105483","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:19.573","lastModified":"2026-11-02T16:17:23.620","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).\n\n`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.\n\nThis vulnerability affects Node.js **26.x** and **24.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"24.22.0","lessThanOrEqual":"24.22.0","versionType":"semver","status":"affected"},{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:34:42.524980Z","id":"CVE-2026-105483","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-106070","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:19.917","lastModified":"2026-11-02T16:17:23.797","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.\n\nWhen `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.\n\nThis vulnerability affects Node.js **26.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:33:18.551404Z","id":"CVE-2026-106070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-840"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-106071","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:20.060","lastModified":"2026-11-02T16:17:25.067","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043.\n\nThis vulnerability affects Node.js **26.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:40:16.898483Z","id":"CVE-2026-106071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-106072","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:20.203","lastModified":"2026-11-02T16:17:25.210","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.\n\n`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"22.23.3","lessThanOrEqual":"22.23.3","versionType":"semver","status":"affected"},{"version":"24.22.0","lessThanOrEqual":"24.22.0","versionType":"semver","status":"affected"},{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:39:13.874920Z","id":"CVE-2026-106072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-106073","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:20.343","lastModified":"2026-11-02T16:17:25.350","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"22.23.3","lessThanOrEqual":"22.23.3","versionType":"semver","status":"affected"},{"version":"24.22.0","lessThanOrEqual":"24.22.0","versionType":"semver","status":"affected"},{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:30:46.582743Z","id":"CVE-2026-106073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-106074","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:20.473","lastModified":"2026-11-02T16:17:25.553","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"22.23.3","lessThanOrEqual":"22.23.3","versionType":"semver","status":"affected"},{"version":"24.22.0","lessThanOrEqual":"24.22.0","versionType":"semver","status":"affected"},{"version":"26.12.0","lessThanOrEqual":"26.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:43:34.777507Z","id":"CVE-2026-106074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-330"}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-87901","sourceIdentifier":"support@hackerone.com","published":"2026-10-23T17:17:22.137","lastModified":"2026-11-02T16:17:44.763","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper sanitization in the registration module allows reflected Cross-Site Scripting."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"phpBB","product":"phpBB","defaultStatus":"unaffected","versions":[{"version":"3.3.0","lessThanOrEqual":"3.3.18","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:37:25.670264Z","id":"CVE-2026-87901","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.phpbb.com/community/viewtopic.php?t=2675305","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-115572","sourceIdentifier":"security-advisories@github.com","published":"2026-10-23T20:17:20.940","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:10.604281Z","id":"CVE-2026-115572","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4240","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.2","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-115580","sourceIdentifier":"security-advisories@github.com","published":"2026-10-23T20:17:21.087","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T18:01:08.614500Z","id":"CVE-2026-115580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-834"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4239","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.2","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-115585","sourceIdentifier":"security-advisories@github.com","published":"2026-10-23T20:17:21.230","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:56:24.413370Z","id":"CVE-2026-115585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4240","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.2","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-79982","sourceIdentifier":"vulnerabilities@zephyrproject.org","published":"2026-10-23T20:17:28.167","lastModified":"2026-11-02T16:17:44.307","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool.\n\nThe device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization.\n\nBecause net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely triggerable denial of service. The fix introduces a separate bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE) for the controller-to-host direction while leaving the host-to-device pool at the endpoint packet size, which is already bounds-checked during reassembly."}],"affected":[{"source":"vulnerabilities@zephyrproject.org","affectedData":[{"vendor":"zephyrproject","product":"zephyr","defaultStatus":"unaffected","collectionURL":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","programFiles":["subsys/usb/device_next/class/bt_hci.c"],"programRoutines":[{"name":"bt_hci_tx_sync_in"}],"versions":[{"version":"3.3.0","lessThanOrEqual":"4.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"vulnerabilities@zephyrproject.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:55:21.632059Z","id":"CVE-2026-79982","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerabilities@zephyrproject.org","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/0419defd2391652edc27689d206fcd9c48439d4a","source":"vulnerabilities@zephyrproject.org"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w5px-w97v-c3hj","source":"vulnerabilities@zephyrproject.org"}]}},{"cve":{"id":"CVE-2026-113877","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-23T21:17:21.597","lastModified":"2026-11-02T16:17:27.470","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"HTTP-Headers-ActionPack","modules":["HTTP::Headers::ActionPack"],"programFiles":["lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"],"programRoutines":[{"name":"HTTP::Headers::ActionPack::ContentNegotiation::_language_match"},{"name":"HTTP::Headers::ActionPack::ContentNegotiation::choose_language"}],"repo":"https://github.com/robrwo/perl-HTTP-Headers-ActionPack/","packageURL":"pkg:cpan/HTTP-Headers-ActionPack","versions":[{"version":"0","lessThan":"0.10","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:59:32.790611Z","id":"CVE-2026-113877","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-624"}]}],"references":[{"url":"https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/27","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-115938","sourceIdentifier":"7004884b-51e2-48e8-b4a2-5ca29e80453e","published":"2026-10-23T22:16:59.597","lastModified":"2026-11-02T16:17:29.370","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command."}],"affected":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","affectedData":[{"vendor":"craftcms","product":"cms","defaultStatus":"unaffected","collectionURL":"https://packagist.org","packageName":"craftcms/cms","versions":[{"version":"5.0.0","lessThan":"5.11.2","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThan":"4.18.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:02:44.482817Z","id":"CVE-2026-115938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/craftcms/cms","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://github.com/craftcms/cms/releases/tag/5.11.2","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://www.hckrt.com/hacktivity/HCKRT-DRNL9W","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"}]}},{"cve":{"id":"CVE-2026-115931","sourceIdentifier":"4cdc9741-f887-419a-a2fd-acbbd2729276","published":"2026-10-23T23:17:43.263","lastModified":"2026-11-02T16:17:29.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed."}],"affected":[{"source":"4cdc9741-f887-419a-a2fd-acbbd2729276","affectedData":[{"vendor":"GitroomHQ","product":"postiz-app","defaultStatus":"unaffected","packageName":"postiz-app","repo":"https://github.com/gitroomhq/postiz-app","versions":[{"version":"2.23.0","lessThan":"2.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"4cdc9741-f887-419a-a2fd-acbbd2729276","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:40.311372Z","id":"CVE-2026-115931","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4cdc9741-f887-419a-a2fd-acbbd2729276","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://gadvisory.org/advisories/PSA-2026-JNXM56","source":"4cdc9741-f887-419a-a2fd-acbbd2729276"},{"url":"https://github.com/gitroomhq/postiz-app","source":"4cdc9741-f887-419a-a2fd-acbbd2729276"},{"url":"https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","source":"4cdc9741-f887-419a-a2fd-acbbd2729276"},{"url":"https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","source":"4cdc9741-f887-419a-a2fd-acbbd2729276"}]}},{"cve":{"id":"CVE-2026-115929","sourceIdentifier":"cna@mongodb.com","published":"2026-10-24T01:17:08.250","lastModified":"2026-11-02T16:17:29.030","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB, Inc.","product":"Compass","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.53.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:02:34.714378Z","id":"CVE-2026-115929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb-js/compass/releases/tag/v1.53.1","source":"cna@mongodb.com"},{"url":"https://releases.electronjs.org/release/v44.9.1","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-108013","sourceIdentifier":"psirt@hcl.com","published":"2026-10-24T07:16:44.990","lastModified":"2026-11-02T16:17:26.703","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520."}],"affected":[{"source":"psirt@hcl.com","affectedData":[{"vendor":"HCL Software","product":"BigFix Platform","defaultStatus":"unaffected","versions":[{"version":"Platform 11.0.7 and below + 10.0.16 and below","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@hcl.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:06:10.735192Z","id":"CVE-2026-108013","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134758","source":"psirt@hcl.com"}]}},{"cve":{"id":"CVE-2026-36698","sourceIdentifier":"cve@mitre.org","published":"2026-10-26T15:16:40.710","lastModified":"2026-11-02T16:17:40.860","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:50:17.757875Z","id":"CVE-2026-36698","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"http://xovis.com","source":"cve@mitre.org"},{"url":"https://github.com/JebSec/jebsec-security-advisories/blob/main/advisories/CVE-2026-36698.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-104597","sourceIdentifier":"cve@mitre.org","published":"2026-10-26T20:17:37.780","lastModified":"2026-11-02T16:17:22.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:46:45.468549Z","id":"CVE-2026-104597","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30","source":"cve@mitre.org"},{"url":"https://osmocom.org/issues/7052","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-112547","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:17:47.817","lastModified":"2026-11-02T15:44:47.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:10:09.978869Z","id":"CVE-2026-112547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"3476FA88-6D69-45AF-964B-CCC87BC6F72B"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"2261970E-A960-41EE-B72B-92176680BE87"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112559","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:17:49.520","lastModified":"2026-11-02T15:44:43.320","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"15.8.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"watchOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:08:09.062945Z","id":"CVE-2026-112559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"15.8.2","matchCriteriaId":"94E271C6-96BC-4E2F-9EC5-23CBC8903193"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"26.0","versionEndExcluding":"26.7.2","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"94C660EA-F6CF-42D8-82DA-31BFD33DD524"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"1E6E607C-CE3D-44BC-B7AD-DC1BCDCACA11"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149522","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149523","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149525","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149526","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112609","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:17:53.373","lastModified":"2026-11-02T15:44:35.053","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:19:03.386181Z","id":"CVE-2026-112609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"3476FA88-6D69-45AF-964B-CCC87BC6F72B"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"2261970E-A960-41EE-B72B-92176680BE87"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112614","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:17:54.053","lastModified":"2026-11-02T15:44:27.547","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected app termination."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-26T23:58:55.627269Z","id":"CVE-2026-112614","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"C127EDC4-3F20-4F46-9B90-C32978351A11"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149522","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112616","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:17:54.373","lastModified":"2026-11-02T15:44:21.673","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:02:30.969016Z","id":"CVE-2026-112616","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"3476FA88-6D69-45AF-964B-CCC87BC6F72B"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"2261970E-A960-41EE-B72B-92176680BE87"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"CB28A9B2-0A5D-4BAA-882F-5C0B6B1CE633"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"94C660EA-F6CF-42D8-82DA-31BFD33DD524"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149526","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112617","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:17:54.533","lastModified":"2026-11-02T15:44:14.953","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An information disclosure issue was addressed with improved logic. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:20:40.320626Z","id":"CVE-2026-112617","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"CB28A9B2-0A5D-4BAA-882F-5C0B6B1CE633"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112688","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:18:03.177","lastModified":"2026-11-02T15:45:20.680","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"15.8.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-26T21:58:16.270453Z","id":"CVE-2026-112688","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7","matchCriteriaId":"0896A319-539F-45D2-ACA1-7225AE5C06ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7","matchCriteriaId":"B331E4FC-727F-403B-8689-E647A51204FD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"15.8.2","matchCriteriaId":"94E271C6-96BC-4E2F-9EC5-23CBC8903193"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"26.0","versionEndExcluding":"26.7.2","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149041","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149522","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149523","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112701","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:18:05.020","lastModified":"2026-11-02T15:45:26.663","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:08:15.815849Z","id":"CVE-2026-112701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-112706","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:18:05.683","lastModified":"2026-11-02T15:45:32.257","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"tvOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"watchOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:18:59.454818Z","id":"CVE-2026-112706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"EB2D346D-9FF1-427D-A64A-A2D9C34F3276"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"94C660EA-F6CF-42D8-82DA-31BFD33DD524"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"1E6E607C-CE3D-44BC-B7AD-DC1BCDCACA11"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149524","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149525","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149526","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-113896","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:18:06.267","lastModified":"2026-11-02T15:45:36.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"15.8.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:10:50.842471Z","id":"CVE-2026-113896","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"15.8.2","matchCriteriaId":"94E271C6-96BC-4E2F-9EC5-23CBC8903193"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"26.0","versionEndExcluding":"26.7.2","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"94C660EA-F6CF-42D8-82DA-31BFD33DD524"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149522","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149523","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149526","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-113907","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:18:07.740","lastModified":"2026-11-02T15:45:43.483","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt process memory."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"15.8.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"tvOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"watchOS","versions":[{"version":"0","lessThan":"27.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-27T00:09:38.001980Z","id":"CVE-2026-113907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"95A89207-5DC1-4DBB-BBB6-C614D03B1791"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"58046CBD-2CCD-4E1E-9316-F7080E4D7B08"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionEndExcluding":"15.8.2","matchCriteriaId":"94E271C6-96BC-4E2F-9EC5-23CBC8903193"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"26.0","versionEndExcluding":"26.7.2","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"27.0","versionEndExcluding":"27.2","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"EB2D346D-9FF1-427D-A64A-A2D9C34F3276"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"94C660EA-F6CF-42D8-82DA-31BFD33DD524"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.2","matchCriteriaId":"1E6E607C-CE3D-44BC-B7AD-DC1BCDCACA11"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149521","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149522","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149523","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149524","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149525","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149526","source":"product-security@apple.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84594","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:20:14.133","lastModified":"2026-11-02T15:45:47.437","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149034","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84595","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:20:14.300","lastModified":"2026-11-02T15:45:56.327","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to cause unexpected system termination."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"15.8.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"27.0","matchCriteriaId":"A6CD209B-5C42-4CC2-BF07-60852D12509A"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"27.0","matchCriteriaId":"8A74637E-2BC7-477F-8996-32A3BE7A10DC"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"15.0","versionEndExcluding":"15.8.2","matchCriteriaId":"855F5ECD-CA54-4DB4-8AD6-86383177270D"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"26.0","versionEndExcluding":"26.7.2","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.0","matchCriteriaId":"6F43E9DC-5D72-4325-9965-E6B50054B8E8"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149034","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149035","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149038","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149522","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149523","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84599","sourceIdentifier":"product-security@apple.com","published":"2026-10-26T21:20:14.950","lastModified":"2026-11-02T15:45:59.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","lessThan":"26.7.2","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","lessThan":"15.8","versionType":"custom","status":"affected"},{"version":"0","lessThan":"26.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"tvOS","versions":[{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"watchOS","versions":[{"version":"0","lessThan":"27","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"322F8B78-6467-49C1-BE61-AB834FE342AD"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.2","matchCriteriaId":"63A66827-2B9D-42CE-AABA-C8847A3EABA4"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"15.0","versionEndExcluding":"15.8","matchCriteriaId":"241A56D1-1E33-4317-A053-85AF8E3770B3"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","versionStartIncluding":"26.0","versionEndExcluding":"26.7.2","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.0","matchCriteriaId":"6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.0","matchCriteriaId":"6F43E9DC-5D72-4325-9965-E6B50054B8E8"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","versionEndExcluding":"27.0","matchCriteriaId":"52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF"}]}]}],"references":[{"url":"https://support.apple.com/en-us/149034","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149035","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149036","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149037","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149038","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149042","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149043","source":"product-security@apple.com","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149227","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-117535","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T11:17:34.053","lastModified":"2026-11-02T16:17:30.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"redaxo","product":"core","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.21.3","versionType":"semver","status":"affected"},{"version":"5.21.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:50:20.557071Z","id":"CVE-2026-117535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/redaxo-before-5.21.3-reflected-xss-via-opener-link-in-media-pool","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-117539","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T11:17:34.640","lastModified":"2026-11-02T16:17:30.243","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"darylldoyle","product":"svg-sanitizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:51:13.401174Z","id":"CVE-2026-117539","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-56084","sourceIdentifier":"security_alert@emc.com","published":"2026-10-27T12:17:08.187","lastModified":"2026-11-02T16:17:41.750","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"PowerProtect Data Domain","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.9.0.0 or later","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.13.1.90 or later","versionType":"semver","status":"affected"},{"version":"0","lessThan":"8.3.1.50 or later","versionType":"semver","status":"affected"},{"version":"0","lessThan":"8.6.1.30 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:52:08.193221Z","id":"CVE-2026-56084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-117503","sourceIdentifier":"cna@vuldb.com","published":"2026-10-27T14:16:35.117","lastModified":"2026-11-02T16:17:29.857","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"a2aproject","product":"a2a-go","cpes":["cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"],"modules":["REST SSE handler"],"versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"affected"},{"version":"2.2","status":"affected"},{"version":"2.3","status":"affected"},{"version":"2.4.0","status":"affected"},{"version":"2.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:02:37.548317Z","id":"CVE-2026-117503","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-404"}]}],"references":[{"url":"https://github.com/a2aproject/a2a-go/","source":"cna@vuldb.com"},{"url":"https://github.com/a2aproject/a2a-go/commit/ff6035bd21e44bb3ee1bfa547885b8c08327fa01","source":"cna@vuldb.com"},{"url":"https://github.com/a2aproject/a2a-go/pull/396","source":"cna@vuldb.com"},{"url":"https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-117503","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015052","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/427070","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/427070/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-117554","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T14:16:35.990","lastModified":"2026-11-02T16:17:30.397","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"admidio","product":"admidio","defaultStatus":"unaffected","packageURL":"pkg:composer/admidio/admidio","versions":[{"version":"0","lessThan":"5.0.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:53:51.050433Z","id":"CVE-2026-117554","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-602"}]}],"references":[{"url":"https://github.com/Admidio/admidio","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Admidio/admidio/issues/2231","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Admidio/admidio/releases/tag/v5.0.17","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restriction-bypass-via-events-function-php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-117558","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T14:16:37.840","lastModified":"2026-11-02T16:17:30.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ai-sdlc-framework","product":"ai-sdlc","defaultStatus":"unaffected","packageURL":"pkg:npm/%40ai-sdlc/plugin-mcp-server","versions":[{"version":"0","lessThanOrEqual":"0.31.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:55:01.072019Z","id":"CVE-2026-117558","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/ai-sdlc-framework/ai-sdlc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ai-sdlc-framework/ai-sdlc/blob/ai-sdlc-plugin-v0.31.2/ai-sdlc-plugin/mcp-server/src/tools/check-issue.ts#L15-L19","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ai-sdlc-framework/ai-sdlc/commit/717d7ecf068b714f65955e50fcf5cb4f9a0b5070","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ai-sdlc-framework/ai-sdlc/issues/1970","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ai-sdlc-mcp-server-through-0.31.2-command-injection-via-check-issue-and-check-pr-status","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ai-sdlc-framework/ai-sdlc/issues/1970","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-117562","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T14:16:38.417","lastModified":"2026-11-02T16:17:30.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"anyant","product":"rssant","defaultStatus":"unaffected","versions":[{"version":"1.9.0","lessThanOrEqual":"1.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:57:47.805556Z","id":"CVE-2026-117562","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/anyant/rssant","source":"disclosure@vulncheck.com"},{"url":"https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200","source":"disclosure@vulncheck.com"},{"url":"https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b","source":"disclosure@vulncheck.com"},{"url":"https://github.com/anyant/rssant/issues/155","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-117566","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T14:16:39.017","lastModified":"2026-11-02T16:17:30.927","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"icret","product":"EasyImages2.0","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:59:25.466200Z","id":"CVE-2026-117566","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/icret/EasyImages2.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/icret/EasyImages2.0/blob/2.8.6/app/down.php#L17-L49","source":"disclosure@vulncheck.com"},{"url":"https://github.com/icret/EasyImages2.0/commit/e337a2bee7e7c67eb90bc4364a345c0857cb73aa","source":"disclosure@vulncheck.com"},{"url":"https://github.com/icret/EasyImages2.0/issues/286","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/easyimages2-0-through-2.8.6-unauthenticated-path-traversal-via-down-php-thumb-php-and-info-php","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-117570","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T14:16:39.623","lastModified":"2026-11-02T16:17:31.097","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Vorota-ai","product":"nmap-mcp","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3636afa6ad4e159c7ad07ca35ede644f37db9c5e","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.0,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:00:06.784981Z","id":"CVE-2026-117570","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-183"}]}],"references":[{"url":"https://github.com/Vorota-ai/nmap-mcp","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Vorota-ai/nmap-mcp/blob/3636afa6ad4e159c7ad07ca35ede644f37db9c5e/nmap_mcp/server.py#L440-L446","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Vorota-ai/nmap-mcp/issues/3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nmap-mcp-through-commit-3636afa-permissive-nse-script-allowlist-in-scan-vulnerabilities","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Vorota-ai/nmap-mcp/issues/3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-117603","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-27T14:16:40.233","lastModified":"2026-11-02T16:17:31.263","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"spesmilo","product":"electrum","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.7.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:01:12.487892Z","id":"CVE-2026-117603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-83831","sourceIdentifier":"secure@microsoft.com","published":"2026-10-27T21:19:08.030","lastModified":"2026-11-02T15:43:55.880","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.48","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T03:56:59.466485Z","id":"CVE-2026-83831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*","versionEndExcluding":"154.0.4258.48","matchCriteriaId":"B1303D8D-F37F-43FE-B8FC-96A948C6BA31"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83831","source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-85898","sourceIdentifier":"secure@microsoft.com","published":"2026-10-27T21:19:34.117","lastModified":"2026-11-02T15:43:20.417","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.48","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T03:57:00.874548Z","id":"CVE-2026-85898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*","versionEndExcluding":"154.0.4258.48","matchCriteriaId":"B1303D8D-F37F-43FE-B8FC-96A948C6BA31"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85898","source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-62765","sourceIdentifier":"secure@microsoft.com","published":"2026-10-27T22:17:29.267","lastModified":"2026-11-02T15:38:21.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"149.0.4022.62","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T13:39:34.621753Z","id":"CVE-2026-62765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*","versionEndExcluding":"149.0.4022.62","matchCriteriaId":"28ED4693-E3AC-4701-AAD7-50E12A36DB75"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62765","source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-117610","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-28T03:17:12.777","lastModified":"2026-11-02T15:37:20.433","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"libexpat","product":"libexpat","defaultStatus":"unaffected","repo":"https://github.com/libexpat/libexpat","packageURL":"pkg:github/libexpat/libexpat","versions":[{"version":"0","lessThanOrEqual":"2.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*","versionEndIncluding":"2.9.0","matchCriteriaId":"BDB440AC-B226-48D7-ACC8-F508CE93C755"}]}]}],"references":[{"url":"https://github.com/libexpat/libexpat","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/libexpat/libexpat/pull/1444","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser","source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-118370","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-28T03:17:13.293","lastModified":"2026-11-02T15:35:10.980","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"libexpat","product":"libexpat","defaultStatus":"unaffected","repo":"https://github.com/libexpat/libexpat","packageURL":"pkg:github/libexpat/libexpat","versions":[{"version":"0","lessThanOrEqual":"2.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*","versionEndIncluding":"2.9.0","matchCriteriaId":"BDB440AC-B226-48D7-ACC8-F508CE93C755"}]}]}],"references":[{"url":"https://github.com/libexpat/libexpat","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/libexpat/libexpat/pull/1450","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes","source":"disclosure@vulncheck.com","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-107019","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.667","lastModified":"2026-11-02T16:17:25.687","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:05:57.629709Z","id":"CVE-2026-107019","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-926"}]}],"references":[{"url":"https://f-droid.org/packages/askanimus.arbeitszeiterfassung2/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107019.md","source":"cve@mitre.org"},{"url":"https://gitlab.com/Askanimus/arbeitszeitkonto","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107025","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.277","lastModified":"2026-11-02T16:17:25.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:00:50.736361Z","id":"CVE-2026-107025","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-926"}]}],"references":[{"url":"https://f-droid.org/archive/de.mbutscher.wikiandpad.alphabeta_200300.apk","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107025.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107041","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.937","lastModified":"2026-11-02T16:17:26.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:23:22.252999Z","id":"CVE-2026-107041","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-926"}]}],"references":[{"url":"https://f-droid.org/packages/com.oasisfeng.island.fdroid/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md","source":"cve@mitre.org"},{"url":"https://github.com/oasisfeng/island","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51902","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.417","lastModified":"2026-11-02T16:17:41.497","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:11:02.946892Z","id":"CVE-2026-51902","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/68d7dfa6ecc41caa9945a02dd31156ca","source":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1558","source":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1558","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51832","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T20:17:31.570","lastModified":"2026-11-02T16:17:41.277","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:09:10.677293Z","id":"CVE-2026-51832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://frsecure.com/blog/idrive-vulnerabilities-cve-2026-51831-and-cve-2026-51832/","source":"cve@mitre.org"},{"url":"https://www.idrive.com/release-info#win","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-119203","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.377","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:10:48.181038Z","id":"CVE-2026-119203","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.4","matchCriteriaId":"722AB798-AA9C-48BE-9211-D1616CACAC55"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4289","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.4","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119204","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.527","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.4","matchCriteriaId":"722AB798-AA9C-48BE-9211-D1616CACAC55"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4290","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.4","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119205","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.677","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:20.322109Z","id":"CVE-2026-119205","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.4","matchCriteriaId":"722AB798-AA9C-48BE-9211-D1616CACAC55"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4288","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.4","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7h","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119206","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.817","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.3","matchCriteriaId":"3F9F2310-72A2-40D1-975D-3060FA1BD9DE"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4251","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119207","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.953","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:12:29.821934Z","id":"CVE-2026-119207","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-405"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.3","matchCriteriaId":"3F9F2310-72A2-40D1-975D-3060FA1BD9DE"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4265","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119208","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:20.090","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.3","matchCriteriaId":"3F9F2310-72A2-40D1-975D-3060FA1BD9DE"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4270","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119209","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:20.230","lastModified":"2026-11-02T16:06:04.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:28.155084Z","id":"CVE-2026-119209","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.21.3","matchCriteriaId":"3F9F2310-72A2-40D1-975D-3060FA1BD9DE"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4269","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-117183","sourceIdentifier":"cve@mitre.org","published":"2026-10-30T16:17:41.700","lastModified":"2026-11-02T16:17:29.560","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:35.674798Z","id":"CVE-2026-117183","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/Primandito/CVE-2026-117183","source":"cve@mitre.org"},{"url":"https://github.com/otoyo/astro-notion-blog/issues/255","source":"cve@mitre.org"},{"url":"https://github.com/otoyo/astro-notion-blog/issues/255","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-37468","sourceIdentifier":"cve@mitre.org","published":"2026-10-30T17:17:23.203","lastModified":"2026-11-02T16:17:41.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:06:01.886818Z","id":"CVE-2026-37468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/jhonny606/mybeehome-stored-xss-2025","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-115828","sourceIdentifier":"1443cd92-d354-46d2-9290-d812316ca43a","published":"2026-10-30T20:17:01.970","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device"}],"affected":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","affectedData":[{"vendor":"Delinea","product":"Secret Server","defaultStatus":"unaffected","versions":[{"version":"older versions","lessThanOrEqual":"12.2.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T19:58:37.969450Z","id":"CVE-2026-115828","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://delinea.com/security-advisories","source":"1443cd92-d354-46d2-9290-d812316ca43a"}]}},{"cve":{"id":"CVE-2026-115829","sourceIdentifier":"1443cd92-d354-46d2-9290-d812316ca43a","published":"2026-10-30T20:17:02.107","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only."}],"affected":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","affectedData":[{"vendor":"Delinea","product":"Secret Server","defaultStatus":"unaffected","versions":[{"version":"older versions","lessThanOrEqual":"12.2.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T19:56:41.493585Z","id":"CVE-2026-115829","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://delinea.com/security-advisories","source":"1443cd92-d354-46d2-9290-d812316ca43a"}]}},{"cve":{"id":"CVE-2026-115830","sourceIdentifier":"1443cd92-d354-46d2-9290-d812316ca43a","published":"2026-10-30T20:17:02.240","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response."}],"affected":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","affectedData":[{"vendor":"Delinea","product":"Secret Server","defaultStatus":"unaffected","versions":[{"version":"older versions","lessThanOrEqual":"12.2.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T19:57:39.863665Z","id":"CVE-2026-115830","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://delinea.com/security-advisories","source":"1443cd92-d354-46d2-9290-d812316ca43a"}]}},{"cve":{"id":"CVE-2026-119329","sourceIdentifier":"security-advisories@github.com","published":"2026-10-30T20:17:06.793","lastModified":"2026-11-02T16:17:31.450","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"immich-app","product":"immich","versions":[{"version":"< 3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:07:46.248400Z","id":"CVE-2026-119329","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5","source":"security-advisories@github.com"},{"url":"https://github.com/immich-app/immich/pull/29028","source":"security-advisories@github.com"},{"url":"https://github.com/immich-app/immich/releases/tag/v3.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq","source":"security-advisories@github.com"},{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119341","sourceIdentifier":"security-advisories@github.com","published":"2026-10-30T21:16:52.290","lastModified":"2026-11-02T16:17:31.600","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service. This issue is fixed in version 5.5.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"tesseract-ocr","product":"tesseract","versions":[{"version":"< 5.5.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":0.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:02:19.295936Z","id":"CVE-2026-119341","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-763"}]}],"references":[{"url":"https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23","source":"security-advisories@github.com"},{"url":"https://github.com/tesseract-ocr/tesseract/pull/4645","source":"security-advisories@github.com"},{"url":"https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4","source":"security-advisories@github.com"},{"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83","source":"security-advisories@github.com"},{"url":"https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119343","sourceIdentifier":"security-advisories@github.com","published":"2026-10-30T21:16:53.417","lastModified":"2026-11-02T16:17:31.753","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Stirling-Tools","product":"Stirling-PDF","versions":[{"version":"< 3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:03:09.523793Z","id":"CVE-2026-119343","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Stirling-Tools/Stirling-PDF/commit/0570c4c4d9e7bf4786a02ab770ef75f116ac3719","source":"security-advisories@github.com"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/pull/7018","source":"security-advisories@github.com"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v3.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3x7x-943g-269w","source":"security-advisories@github.com"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3x7x-943g-269w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62300","sourceIdentifier":"security-advisories@github.com","published":"2026-10-30T21:17:13.670","lastModified":"2026-11-02T16:17:41.937","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a caller-supplied CID with `CID.parse` and passes it to `pinStore.pin`, but does not enforce request rate limits or per-user quotas. In `src/filecoin-pin-store.ts`, each pin independently schedules `_processPinInBackground` with `setTimeout` without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using `helia.pins.add(cid)`. The per-pin Helia/Bitswap node in `src/create-pinning-helia.ts` has no application-level byte, block or traversal-time limits. Blocks are written under `carStoragePath` by `src/core/car/car-blockstore-base.ts` and `src/core/car/car-file-backend.ts`, with `stats.totalSize` updated only after writing. An authenticated caller, or an anonymous caller when `ALLOW_NO_AUTH=true`, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied `origins` can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"filecoin-project","product":"filecoin-pin","versions":[{"version":"<= 1.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:01:29.977323Z","id":"CVE-2026-62300","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/filecoin-project/filecoin-pin/commit/8db22b47899deb78dadf415fc477cae4bd6e82c2","source":"security-advisories@github.com"},{"url":"https://github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-m5ph-mmg5-6w5h","source":"security-advisories@github.com"},{"url":"https://github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-m5ph-mmg5-6w5h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62864","sourceIdentifier":"security-advisories@github.com","published":"2026-10-30T21:17:14.693","lastModified":"2026-11-02T16:17:42.100","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"ring-clojure","product":"ring","versions":[{"version":"< 1.15.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:29.414692Z","id":"CVE-2026-62864","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e","source":"security-advisories@github.com"},{"url":"https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj","source":"security-advisories@github.com"},{"url":"https://github.com/ring-clojure/ring/tree/1.15.5","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-62989","sourceIdentifier":"security-advisories@github.com","published":"2026-10-30T21:17:15.873","lastModified":"2026-11-02T16:17:42.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"shopperlabs","product":"shopper","versions":[{"version":"< 2.10.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:06:33.131571Z","id":"CVE-2026-62989","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/shopperlabs/shopper/commit/3c814f3b8eaf7cd2296c213bec0ce91e9f92a3f2","source":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/pull/573","source":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/releases/tag/v2.10.0","source":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc","source":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77152","sourceIdentifier":"mlhess@drupal.org","published":"2026-10-31T00:16:51.597","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the \"edit field collections\" permission to bypass access control on the parent (host) entity.\n\nThe access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the \"edit field collections\" permission without verifying the user's access to the host entity. As a result, a user with \"edit field collections\" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission.\n\n\n\nThis issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2."}],"affected":[{"source":"mlhess@drupal.org","affectedData":[{"vendor":"Drupal","product":"Field Collection for Drupal 7","defaultStatus":"unaffected","collectionURL":"https://www.drupal.org/project/field_collection","repo":"https://git.drupalcode.org/project/field_collection","versions":[{"version":"7.x-1.0","lessThanOrEqual":"7.x-1.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"mlhess@drupal.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"mlhess@drupal.org","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://d7es.tag1.com/security-advisories?field_project_target_id=96","source":"mlhess@drupal.org"},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-77152","source":"mlhess@drupal.org"}]}},{"cve":{"id":"CVE-2026-110176","sourceIdentifier":"mlhess@drupal.org","published":"2026-10-31T01:17:05.153","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\n\n\n\nIn versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected."}],"affected":[{"source":"mlhess@drupal.org","affectedData":[{"vendor":"Drupal","product":"File Force Download","defaultStatus":"unaffected","collectionURL":"https://www.drupal.org/project/file_force","packageName":"file_force","platforms":["Drupal 7"],"repo":"https://git.drupalcode.org/project/file_force","versions":[{"version":"7.1.0","lessThan":"7.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"mlhess@drupal.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"mlhess@drupal.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass","source":"mlhess@drupal.org"},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-110176","source":"mlhess@drupal.org"}]}},{"cve":{"id":"CVE-2026-100155","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:29.350","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kstover","product":"Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.15.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:50:33.517770Z","id":"CVE-2026-100155","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/AJAX/Controllers/Submission.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/AJAX/Controllers/Submission.php#L60","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Abstracts/MergeTags.php#L64","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Actions/SuccessMessage.php#L63","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Actions/SuccessMessage.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/MergeTags/Fields.php#L268","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3749135%40ninja-forms%2Ftags%2F3.15.6&old=3717122%40ninja-forms%2Ftags%2F3.15.5","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/ninja-forms/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cf42f7-77c6-4594-a6a4-cebf5c3558d7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-101326","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:31.217","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an administrator has configured at least one Ninja Forms field with its Default Value set to the {wp:user_display_name} merge tag on a publicly accessible page; a Subscriber need only set their display_name to a shortcode string via their profile and then visit that page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kstover","product":"Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.15.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Abstracts/MergeTags.php#L94","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Config/MergeTagsWP.php#L128","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Display/Render.php#L268","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Display/Render.php#L278","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/MergeTags/WP.php#L189","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/includes/Display/Render.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/ninja-forms/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dccb32-e638-4929-a788-3998bc3acd75?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109234","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:31.510","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tigroumeow","product":"Meow Lightbox","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.6.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:35:03.254607Z","id":"CVE-2026-109234","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1115","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1276","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L901","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/vendor/kub-at/php-simple-html-dom-parser/src/KubAT/PhpSimple/lib/simple_html_dom.php#L2043","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/vendor/kub-at/php-simple-html-dom-parser/src/KubAT/PhpSimple/lib/simple_html_dom.php#L490","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=/meow-lightbox/tags/5.6.4&new_path=/meow-lightbox/tags/5.6.5","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45fcd17e-10d5-4357-84cc-2527b07b584e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109997","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:31.853","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nf_ajax_submit endpoint issues a valid nonce to any requester on failure, effectively neutralizing the nonce check and making exploitation trivially achievable in a single unauthenticated request."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kstover","product":"Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.15.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:59.887321Z","id":"CVE-2026-109997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/AJAX/Controllers/Submission.php#L428","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/AJAX/Controllers/Submission.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Actions/Save.php#L311","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Admin/Metaboxes/Calculations.php#L23","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Database/Models/Submission.php#L731","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Templates/admin-metaboxes-calcs.html.php#L4","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/includes/Templates/admin-metaboxes-calcs.html.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/ninja-forms/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54da4deb-e50c-478d-ab99-222c5573a036?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110042","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:32.120","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Payment Forms for Paystack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.0.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:28:34.339746Z","id":"CVE-2026-110042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/49c8fecd-b944-4290-af2f-57a3d4cb06e1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110808","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:32.377","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Essential Addons for Elementor  WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor.\nThis is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Essential Addons for Elementor","defaultStatus":"unaffected","versions":[{"version":"6.6.0","lessThan":"6.8.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:28:25.516256Z","id":"CVE-2026-110808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://wpscan.com/vulnerability/aea51ee6-e1cd-4110-8d07-76cf8f87b2e4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-116520","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:32.630","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because WordPress's comment_content filter leaves bare shortcode text (containing no HTML tags) untouched, and the comment_whitelist setting auto-approves subsequent comments from a previously approved name and email without administrator intervention."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"buildwps","product":"PPWP – Password Protect Pages","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.9.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:57.940258Z","id":"CVE-2026-116520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L202","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L587","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L598","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L608","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L622","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/views/shortcode/view-ppw-restriced-content-form.php#L17","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3772960/password-protect-page/trunk/includes/services/class-ppw-shortcode.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c549ba14-276e-46ab-8019-97430a566d8c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116563","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:32.860","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have Shutter or Shutter Reloaded selected as the active lightbox, and the injected comment must be approved through WordPress's standard moderation workflow before the payload is rendered to other visitors."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"smub","product":"Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:35:06.384201Z","id":"CVE-2026-116563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.4/static/Lightbox/shutter/nextgen_shutter.js#L120","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.4/static/Lightbox/shutter/shutter.js#L197","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.4/static/Lightbox/shutter/shutter.js#L67","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.4/static/Lightbox/shutter_reloaded/nextgen_shutter_reloaded.js#L118","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.4/static/Lightbox/shutter_reloaded/shutter.js#L247","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.5.4/static/Lightbox/shutter_reloaded/shutter.js#L75","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3773860/nextgen-gallery/trunk/static/Lightbox/shutter/shutter.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18dc9c01-c849-40c3-87ec-5eebc9660aff?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118043","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:33.080","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Bulk Media Register","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.01","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":5.3}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:28:15.959496Z","id":"CVE-2026-118043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/bcb6cb6b-d1bc-4c92-8c3b-4ad48348a2b1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118184","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:33.253","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Premium Packages  WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Premium Packages","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:28:07.336628Z","id":"CVE-2026-118184","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/38c4d58a-20a3-4309-ace7-5b567257c80e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118185","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:33.503","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Security Optimizer  WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Security Optimizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:27:56.910781Z","id":"CVE-2026-118185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118437","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:33.703","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"BuddyForms","defaultStatus":"unaffected","versions":[{"version":"2.8.8","lessThan":"2.10.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:27:46.715798Z","id":"CVE-2026-118437","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://wpscan.com/vulnerability/20a483cf-7003-4d5a-9abb-afcc3f985ee4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118438","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:33.923","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Firelight Lightbox","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.24","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:27:37.269884Z","id":"CVE-2026-118438","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118629","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:34.133","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All-in-One Video Gallery  WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"All-in-One Video Gallery","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:27:23.131338Z","id":"CVE-2026-118629","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a17559f9-f2d6-434f-8dd0-db4d1d9766d2/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118638","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:34.330","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Mapster WP Maps","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:27:12.972455Z","id":"CVE-2026-118638","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3d3004f1-46f1-479d-bae6-754e56d3aa7e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-119977","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:34.550","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"WordPress Foundation","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.38","versionType":"semver","status":"affected"},{"version":"4.8.0","lessThanOrEqual":"4.8.33","versionType":"semver","status":"affected"},{"version":"4.9.0","lessThanOrEqual":"4.9.34","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThanOrEqual":"5.0.30","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThanOrEqual":"5.1.27","versionType":"semver","status":"affected"},{"version":"5.2.0","lessThanOrEqual":"5.2.29","versionType":"semver","status":"affected"},{"version":"5.3.0","lessThanOrEqual":"5.3.26","versionType":"semver","status":"affected"},{"version":"5.4.0","lessThanOrEqual":"5.4.24","versionType":"semver","status":"affected"},{"version":"5.5.0","lessThanOrEqual":"5.5.23","versionType":"semver","status":"affected"},{"version":"5.6.0","lessThanOrEqual":"5.6.22","versionType":"semver","status":"affected"},{"version":"5.7.0","lessThanOrEqual":"5.7.20","versionType":"semver","status":"affected"},{"version":"5.8.0","lessThanOrEqual":"5.8.18","versionType":"semver","status":"affected"},{"version":"5.9.0","lessThanOrEqual":"5.9.19","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.0.17","versionType":"semver","status":"affected"},{"version":"6.1.0","lessThanOrEqual":"6.1.15","versionType":"semver","status":"affected"},{"version":"6.2.0","lessThanOrEqual":"6.2.14","versionType":"semver","status":"affected"},{"version":"6.3.0","lessThanOrEqual":"6.3.13","versionType":"semver","status":"affected"},{"version":"6.4.0","lessThanOrEqual":"6.4.13","versionType":"semver","status":"affected"},{"version":"6.5.0","lessThanOrEqual":"6.5.13","versionType":"semver","status":"affected"},{"version":"6.6.0","lessThanOrEqual":"6.6.10","versionType":"semver","status":"affected"},{"version":"6.7.0","lessThanOrEqual":"6.7.10","versionType":"semver","status":"affected"},{"version":"6.8.0","lessThanOrEqual":"6.8.11","versionType":"semver","status":"affected"},{"version":"6.9.0","lessThanOrEqual":"6.9.10","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.0.7","versionType":"semver","status":"affected"},{"version":"7.1.0","lessThanOrEqual":"7.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162","source":"security@wordfence.com"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378","source":"security@wordfence.com"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549","source":"security@wordfence.com"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282","source":"security@wordfence.com"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346","source":"security@wordfence.com"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545","source":"security@wordfence.com"},{"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-82214","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:34.920","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Quick Event Manager","defaultStatus":"unaffected","versions":[{"version":"8.4.6","lessThan":"9.19","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:27:00.216120Z","id":"CVE-2026-82214","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b3ccecb9-4544-4944-a31a-f5aed7dcc95e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-92294","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:35.153","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"brainstormforce","product":"Spectra Legacy – Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.20.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L101","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L584","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L93","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-loader.php#L302","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3736176/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ad515a-3c0b-47f5-919b-0d17f693c049?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-94361","sourceIdentifier":"contact@wpscan.com","published":"2026-10-31T06:16:35.460","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Payable Payment Gateway for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:26:40.490559Z","id":"CVE-2026-94361","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1c6a831e-2d14-4c73-8a9e-d28d9262f626/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-107653","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:32.940","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g. a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"surecart","product":"SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:51.969851Z","id":"CVE-2026-107653","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/app/src/BlockLibrary/BlockServiceProvider.php#L100","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/app/src/BlockLibrary/BlockServiceProvider.php#L152","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/app/src/Support/kses.json#L1263","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/dist/components/collection/components/controllers/confirmation/manual-instructions/sc-order-manual-instructions.js","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3742278/surecart/trunk/app/src/BlockLibrary/BlockServiceProvider.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2329870b-3285-4fb2-92d1-8107eb101dff?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107750","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:33.920","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., &lt;img onerror=…&gt;) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpovernight","product":"PDF Invoices & Packing Slips for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.16.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:35.018819Z","id":"CVE-2026-107750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/BulkDocument.php#L143","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/OrderDocument.php#L1699","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/OrderDocumentMethods.php#L1217","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/OrderDocumentMethods.php#L99","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/wpo-ips-functions.php#L630","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3756047/woocommerce-pdf-invoices-packing-slips/trunk/includes/Documents/OrderDocument.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9456cd66-d608-49b8-ad4c-fdc89db4cd29?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107765","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.070","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. This is due to insufficient output escaping in the ctdb_filter_comment_author_name() callback hooked to get_comment_author_link, which interpolates the raw user_url value into a single-quoted href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a Discussion Board topic containing the attacker's reply."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"marketingfire","product":"Discussion Board – WordPress Forum Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:41.309547Z","id":"CVE-2026-107765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-skins.php#L43","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-user.php#L83","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-user.php#L92","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3761217/wp-discussion-board/trunk/includes/functions/functions-user.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbb177e-3cf8-48fe-9660-999c177cbeb5?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109217","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.220","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpovernight","product":"PDF Invoices & Packing Slips for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.16.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-524"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Documents/Invoice.php#L146","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L181","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L239","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.4/includes/Main.php#L253","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3759839%40woocommerce-pdf-invoices-packing-slips&new=3759839%40woocommerce-pdf-invoices-packing-slips","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e68495ad-53ab-4c6b-aecc-1e4bfe34aa0d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109220","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.367","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"addonsorg","product":"PDF Invoice for WooCommerce + Drag and Drop Template Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://downloads.wordpress.org/plugin/pdf-for-woocommerce.7.2.0.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/frontend/index.php#L378","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlDocument.php#L300","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlNode.php#L1266","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/vendor/mpdf/mpdf/src/Mpdf.php#L9105","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/emails/index.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/shortcodes.php#L708","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc3529c-6161-4b89-8a35-c3a9b7b8c308?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109386","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.517","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values — diverting all subsequent Hustle form lead submissions to the attacker's ESP tenant — and, for HubSpot, irreversibly delete the operator's OAuth token, OAuth referer, and OAuth current-page option rows. This requires the attacker to hold the plugin-granted hustle_create capability (e.g., an Editor delegated hustle_create but not hustle_edit_integrations via Hustle's Permissions tab), which allows them to load a Hustle module wizard page and obtain the hustle_provider_action nonce needed to reach the vulnerable handlers."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpmudev","product":"Hustle – Email Marketing, Lead Generation, Optins, Popups","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.8.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L509","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L533","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L576","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L610","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L652","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/provider/class-hustle-provider-admin-ajax.php#L667","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.3/inc/providers/hubspot/hustle-hubspot-api.php#L310","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.14.4/inc/provider/class-hustle-provider-admin-ajax.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26c0279-0b51-40a8-8d11-6f2cbb21e59a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110251","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.673","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the `delete_reviews_image()` function's `delete_comment` hook trusting attachment IDs supplied via the `wcpr_image_upload_id` POST parameter that were stored in comment meta without any ownership or capability check — `viwcpr_filter_review_image_ids()` verifies only that each submitted ID refers to an attachment post type, not that the submitter uploaded or owns it. This makes it possible for unauthenticated attackers to permanently delete any WordPress media library attachment — including its files on disk as recorded by `wp_delete_attachment()` — by embedding attacker-chosen attachment IDs into a review comment, then waiting for a moderator to remove the review or for WordPress core's `wp_scheduled_delete` cron to purge it after `EMPTY_TRASH_DAYS`. The nonce required to submit the parameter (`wcpr_image_upload`) is a shared public value printed on every product page for guest commenters and does not function as an authentication barrier, making this trivially exploitable without any account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"villatheme","product":"Revopic – Photo Reviews for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.31","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/admin/admin.php#L2403","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/frontend/frontend.php#L1232","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/frontend/frontend.php#L1267","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/includes/functions.php#L84","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/woo-photo-reviews/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4d8f9-7b25-4c31-8457-2cb45bd17150?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111109","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.827","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wp_filter_kses / wp_filter_post_kses hooks on pre_comment_content before calling wp_new_comment(), so the payload is persisted to comment_content as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"pfefferle","product":"Webmention","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.10.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:53.986526Z","id":"CVE-2026-111109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/pfefferle/wordpress-webmention/pull/698","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/webmention/tags/5.10.1/includes/class-receiver.php#L267","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/webmention/tags/5.10.1/includes/class-receiver.php#L453","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/webmention/tags/5.10.1/includes/entity/class-item.php#L125","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/webmention/tags/5.10.1/includes/entity/class-item.php#L297","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/webmention/tags/5.10.1/includes/handler/class-meta.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/webmention/tags/5.10.2/includes/class-receiver.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b283d17-b89f-467d-8a79-cdf7b9bfdb65?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111254","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:34.987","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Pro license was previously active with REST caching enabled and has since become inactive while Disk Enhanced page caching remains configured, and that the attacker holds a previously approved commenter identity."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldgrid","product":"W3 Total Cache","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.10.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:55.977038Z","id":"CVE-2026-111254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/BoldGrid/w3-total-cache/commit/7168b0d7cc80e827ad234a0428ab3ecdbef3c107","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/Licensing_Plugin_Admin.php#L928","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/PgCache_ContentGrabber.php#L1450","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/PgCache_ContentGrabber.php#L1719","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3757452/w3-total-cache/trunk/PgCache_ContentGrabber.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0169909e-c6cd-4d08-8301-5e09fce4429c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-115840","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:35.140","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin itself emits to unauthenticated visitors on the public booking-confirmation page, allowing an attacker to obtain a valid token without any account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"e4jvikwp","product":"VikRentCar Car Rental Management System","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:32.981304Z","id":"CVE-2026-115840","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.10/libraries/lite/helper.php#L211","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/libraries/lite/helper.php#L221","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/views/cardetails/tmpl/default.php#L174","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/views/oconfirm/tmpl/default.php#L811","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/vikrentcar.php#L348","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9514757b-903d-45af-b612-cfabc09abbaa?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116522","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:35.410","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have both the comment indexing and comment highlighting options enabled, and the payload only fires when a visitor reaches a singular page via a Relevanssi search-result permalink carrying the highlight query parameter."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"comesio","product":"Relevanssi – A Better Search","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.28.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:45.610719Z","id":"CVE-2026-116522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/msaari/relevanssi/commit/b0324957b27e2dfc2aa116c96dcf578fbec9e0e5","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/common.php#L1037","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/excerpts-highlights.php#L1698","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/excerpts-highlights.php#L521","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/excerpts-highlights.php#L688","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/init.php#L140","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3767703%40relevanssi%2Ftags%2F4.28.6&old=3761637%40relevanssi%2Ftags%2F4.28.5","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442403ae-9011-4373-a363-e98e07ec7e9b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116546","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:35.563","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's self-registration flow allows any visitor to create a Subscriber-backed Employer account, meaning this vulnerability is effectively exploitable by any user who can register on the site."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpjobportal","product":"WP Job Portal – AI-Powered Recruitment System for Company or Job Board website","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.7.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:43.583314Z","id":"CVE-2026-116546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://downloads.wordpress.org/plugin/wp-job-portal.2.7.1.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/controller.php#L441","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L1008","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L3728","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L3762","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/modules/job/model.php#L3824","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.7.0/wp-job-portal.php#L1786","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45bc4b00-1b5e-4c2e-96c7-77e03b86be5c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116548","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:35.717","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"e4jvikwp","product":"VikRentCar Car Rental Management System","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:28.818034Z","id":"CVE-2026-116548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/admin/views/editbusy/tmpl/default.php#L568","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php#L568","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php#L602","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/controller.php#L169","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/controller.php#L668","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116557","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:35.857","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"murgroland","product":"WP Booking System – Booking Calendar","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L111","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L119","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L123","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3765778/wp-booking-system/trunk/includes/base/admin/calendar/functions-notes.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old=3755940&old_path=%2Fwp-booking-system%2Ftrunk&new=3765778&new_path=%2Fwp-booking-system%2Ftrunk","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118070","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.007","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is staged by an unauthenticated visitor who forges the ROBOT PAYMENT browser-return request, storing the malicious gid value in order metadata; the script then fires when an administrator opens that order in the WordPress admin panel."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"uscnanbu","product":"Welcart e-Commerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.12.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:30.949432Z","id":"CVE-2026-118070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/paymentJPayment.class.php#L556","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/functions/template_func.php#L3279","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/functions/utility.php#L1553","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop/trunk/functions/template_func.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e73872-bd1a-4b3a-9021-d0cd648456eb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119065","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.163","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"arosoft","product":"Shipping Zones by Drawing for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:26.356368Z","id":"CVE-2026-119065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1061","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1105","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1133","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1169","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3774334%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.1&old=3769379%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.0","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/log/shipping-zones-by-drawing-for-woocommerce/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87daf87-2afb-433c-bb90-1d7469953bcc?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119089","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.313","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"supercleanse","product":"ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.12.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:47.752247Z","id":"CVE-2026-119089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/thirstyaffiliates/tags/3.12.1/Models/Affiliate_Links_CPT.php#L747","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/thirstyaffiliates/tags/3.12.1/Models/Link_Picker.php#L667","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/thirstyaffiliates/tags/3.12.1/Models/Link_Picker.php#L734","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3773776%40thirstyaffiliates&new=3773776%40thirstyaffiliates","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4182c4bb-fc3e-44d8-95d9-cd96ba898a34?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119162","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.457","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On a default installation the submitted post is held as Pending and requires admin approval before the payload is reachable by other visitors; however, if the plugin's \"publish immediately\" option is enabled, no approval step exists and the stored payload becomes live without any moderator interaction."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"specialk","product":"User Submitted Posts – Enable Users to Submit Posts from the Front End","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"20260916","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:39.206794Z","id":"CVE-2026-119162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/library/shortcode-login.php#L80","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/user-submitted-posts.php#L1426","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/user-submitted-posts.php#L440","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/user-submitted-posts.php#L643","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3773792/user-submitted-posts/trunk/library/shortcode-login.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6486ffd9-4c8b-49a0-8493-0743f945b0f6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119163","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.600","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfan_cart_id value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"teamfunnelkit","product":"FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.8.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.8.5.2/includes/db/class-bwfan-model-automation-contact.php#L132","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.8.5.2/modules/abandoned-cart/class-bwfan-abandoned.php#L1007","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.8.5.2/modules/abandoned-cart/class-bwfan-abandoned.php#L414","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3759554/wp-marketing-automations/trunk/includes/db/class-bwfan-model-automation-contact.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22399b2a-75e5-428d-a9a2-8b42e23c1825?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119166","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.750","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"uscnanbu","product":"Welcart e-Commerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.12.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L3848","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L4470","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5070","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5509","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop/trunk/classes/usceshop.class.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119980","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:36.920","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"stiofansisland","product":"UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.78","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/AyeCode/userswp/archive/refs/heads/master.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-forms.php#L5244","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-templates.php#L850","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-tools.php#L606","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.78/includes/class-userswp.php#L565","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3774438/userswp/trunk/includes/class-tools.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c458034-9c44-4b46-8845-4c05bea043a0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-11396","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:37.073","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"woobewoo","product":"Product Filter for WooCommerce by WBW","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.4.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/controller.php#L864","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3757178%40woo-product-filter&new=3757178%40woo-product-filter","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b51837-5925-497f-bdb8-c32f9011830b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-120019","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:37.227","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires HTML Minify to be enabled with the default 'mfunc' entry present in the ignored-comment stems list, and exploitation depends on the attacker predicting the md5(time()) placeholder namespace by reading the server clock via the HTTP Date response header within the applicable time window."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldgrid","product":"W3 Total Cache","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.10.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:49.871077Z","id":"CVE-2026-120019","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/BoldGrid/w3-total-cache/commit/35c6896332aff6b41888db0595cf09b4c98c814c","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/Minify_Plugin.php#L625","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/lib/Minify/Minify/IgnoredCommentPreserver.php#L10","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/lib/Minify/Minify/IgnoredCommentPreserver.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3757452/w3-total-cache/trunk/lib/Minify/Minify/IgnoredCommentPreserver.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a14a537-64e7-415b-be8e-a3a9377fd20d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-120040","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:37.370","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wardee","product":"Mail logging & Catcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/JWardee/wp-mail-catcher/releases/tag/v2.3.0","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L101","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L259","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Loggers/WpMail.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/HtmlMessage.php#L9","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/TextMessage.php#L10","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/599e46ed-a71c-41d1-839f-6bb76808a58f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-88942","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:37.540","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"woobewoo","product":"Product Filter for WooCommerce by WBW","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.4.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:37.219182Z","id":"CVE-2026-88942","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/wpcodefactory/woo-product-filter","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/classes/class-woobewoo-pf-frame.php#L391","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/classes/class-woobewoo-pf-response.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L359","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L363","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L513","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L739","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-frame.php#L391","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-response.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L359","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L363","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L513","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L739","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3757178/woo-product-filter/trunk/classes/class-woobewoo-pf-response.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f80f84-68b1-4c11-8bc8-19b78e253129?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-89270","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T07:16:37.707","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"popupbuilder","product":"Popup Builder – Create highly converting, mobile friendly marketing popups.","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L43","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L435","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1826","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1830","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L257","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3755160/popup-builder/trunk/com/classes/popups/SGPopup.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/popup-builder/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2025-11455","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:46.970","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tigroumeow","product":"Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:53:28.103434Z","id":"CVE-2025-11455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?old_path=/wp-retina-2x/tags/7.2.0&new_path=/wp-retina-2x/tags/7.2.1","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb730d0-1394-4716-bddd-efa55d6e4bf3?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2025-9462","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:47.313","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.5.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tobias_conrad","product":"WP2LEADS |  WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.5.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp2leads/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp2leads/tags/3.5.3/includes/library/MapBuilderManager.php#L71","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3766159/wp2leads/trunk/includes/library/MapBuilderManager.php","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/wp2leads/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f432ed8-7b99-44ad-a847-90236e977347?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103898","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:47.460","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"roxnor","product":"Wp Social Login and Register Social Counter","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L172","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L229","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L512","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-rest-api.php#L46","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Facebook.php#L205","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Twitter.php#L102","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3752566%40wp-social&new=3752566%40wp-social","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e961d3db-da5e-4bde-ae7e-04e6ba3ebef4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103962","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:47.613","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wedevs","product":"User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.3.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:17.700822Z","id":"CVE-2026-103962","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend.php#L311","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/wpuf-functions.php#L2025","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/wpuf-functions.php#L2045","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/wpuf-functions.php#L2120","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3770255/wp-user-frontend/trunk/wpuf-functions.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9e7f3e-900c-4e84-8226-8dc6450b0a31?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103997","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:47.753","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the entire Redux options payload — including plaintext password field values, API keys, license keys, and SMTP credentials — exposed in the inline redux_&lt;opt_name&gt; JavaScript block on wp-admin/profile.php. The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, meaning any site running Redux Framework is affected regardless of whether the developer explicitly configured the Users extension."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"davidanderson","product":"Redux Framework","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.5.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/reduxframework/redux-framework/pull/4119","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/classes/class-redux-enqueue.php#L582","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/classes/class-redux-enqueue.php#L735","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L156","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L484","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.16/redux-core/inc/classes/class-redux-enqueue.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1dd83e6-ea48-459b-84ac-3c6fff9cd940?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104012","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:47.893","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1)."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"roxnor","product":"Rox Appointment Booking – Event, Calendar & Appointment Scheduling","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:50:55.700006Z","id":"CVE-2026-104012","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107759","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.033","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpo365","product":"WPO365 | MICROSOFT 365 GRAPH MAILER","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:15.381772Z","id":"CVE-2026-107759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Core/Script_Helpers.php#L142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Mail/Mailer.php#L71","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Ajax_Service.php#L284","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Log_Service.php#L80","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/apps/dist/wizard-chunk-G9IB6WhS.js#L154","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3752919%40wpo365-msgraphmailer&new=3752919%40wpo365-msgraphmailer","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51ba0c2-588d-4241-977a-9649cb77c78e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110023","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.180","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"peterschulznl","product":"WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.5.88","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L1040","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L1060","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L1156","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L2636","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L308","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3758843%40wp-data-access%2Ftags%2F5.5.89&old=3744640%40wp-data-access%2Ftags%2F5.5.88","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ffa22b-43d0-48aa-8147-db0a9c49a7b9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111070","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.323","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from each remotely-fetched article (WPCP_Readability::parse_meta()), piping that value through the article template substitution and html_entity_decode() in WPCP_Module::insert_post(), and then calling wp_insert_post() after switching the current user to the configured campaign author (an Administrator with the unfiltered_html capability by default) — so no wp_kses_post sanitization is applied to the attacker-controlled HTML before it is persisted as post_content and rendered on the front end. This makes it possible for unauthenticated attackers who control the content of any RSS source an administrator has configured a Content Pilot RSS campaign to consume to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"pluginever","product":"Content Pilot – Autoblogging & Affiliate Marketing Suite","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:12.606669Z","id":"CVE-2026-111070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-content-pilot/tags/2.2.4/includes/class-wpcp-module.php#L315","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-content-pilot/tags/2.2.4/includes/class-wpcp-module.php#L425","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-content-pilot/tags/2.2.4/includes/class-wpcp-readability.php#L182","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-content-pilot/tags/2.2.4/includes/class-wpcp-readability.php#L274","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-content-pilot/tags/2.2.4/includes/modules/class-wpcp-feed.php#L204","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-content-pilot/tags/2.2.5/includes/class-wpcp-module.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3afda72-c10b-46e0-b187-03bcaeb77ea4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111592","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.463","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (maps to display_name)' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker's user account to have a mapped author term, which occurs when an administrator has assigned them as a co-author on content or has enabled automatic author term creation for their role — this mapping is not present by default for new users on a stock install."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"publishpress","product":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.17.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:24.057048Z","id":"CVE-2026-111592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.17.0/src/core/Classes/Author_Editor.php#L86","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.17.0/src/modules/multiple-authors/multiple-authors.php#L302","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.17.0/src/modules/multiple-authors/multiple-authors.php#L5233","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.18.0/src/core/Classes/Author_Editor.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329226bc-7d0e-45e0-8ac0-656517e0e4ca?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116512","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.603","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wedevs","product":"Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:51:17.934940Z","id":"CVE-2026-116512","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validator.php#L156","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Project.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3772103/wedevs-project-manager/trunk/core/Validator/Abstract_Validator.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116535","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.757","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber who sets their display_name to a string containing the literal %%archive_title%% token alongside HTML event-handler payloads, as WordPress stores display names without HTML filtering and the plugin substitutes the token after escaping has already occurred."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"rainbowgeek","product":"SEOPress – AI SEO Plugin & On-site SEO","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"10.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:19.802986Z","id":"CVE-2026-116535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.svn.wordpress.org/wp-seopress/trunk/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.3/inc/functions/options-social.php#L1104","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.3/inc/functions/options-social.php#L1112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.3/inc/functions/options-social.php#L533","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.3/inc/functions/options-social.php#L542","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.3/inc/functions/options-titles-metas.php#L403","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-seopress/tags/10.3/inc/functions/variables/dynamic-variables.php#L340","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3772366/wp-seopress/trunk/inc/functions/options-social.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6651c932-aa60-485b-bb5b-b66d5a8963ae?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118057","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:48.903","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The hidden 'path' column in ForTraffic.php lacks a client-side render function, so DataTables builds its cell via innerHTML, causing stored HTML in the path value to be parsed into live DOM nodes; a prior partial fix in version 18.5.8 added esc_html() only to the visible 'page' column, leaving the hidden 'path' field unescaped and exploitable through version 22.2.6."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"paultgoodchild","product":"Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"22.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:21.965782Z","id":"CVE-2026-118057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Logging/Processors/RequestMetaProcessor.php#L104","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Logging/Processors/RequestMetaProcessor.php#L28","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Tables/DataTables/Build/ForTraffic.php#L129","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Tables/DataTables/LoadData/Traffic/BuildTrafficTableData.php#L67","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3769612%40wp-simple-firewall%2Ftags%2F22.3.4&old=3768418%40wp-simple-firewall%2Ftags%2F22.3.2","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3781bf74-541a-4dfb-a058-1a9ea6aa970e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119096","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:49.043","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"uncannyowl","product":"Uncanny Toolkit for LearnDash","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3357","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3446","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3527","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3559","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3773997/uncanny-learndash-toolkit/trunk/src/classes/frontend-login-plus.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592b61a1-9ac9-4817-b154-1e39e50d8010?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-120070","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T08:16:49.183","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role=\"editor\"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor — or the attacker themselves — can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wedevs","product":"User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.3.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L132","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L253","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend/Registration.php#L116","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend/Registration.php#L362","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3770255/wp-user-frontend/trunk/includes/Ajax/Frontend_Form_Ajax.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84b6767-f254-45c9-8e78-36d4beac2a98?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-101325","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:32.323","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by simply subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"contrid","product":"Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.18.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:33:26.455170Z","id":"CVE-2026-101325","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/includes/checkinit.php#L269","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/models/subscriber.php#L1294","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/wp-mailinglist-plugin.php#L5008","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/wp-mailinglist-plugin.php#L5076","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3756587/newsletters-lite/trunk/wp-mailinglist-plugin.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bc05a2-25f9-4276-8541-a77efc7bd617?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103882","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:32.510","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"acadlix","product":"Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/Assets/Manager.php#L570","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L680","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L692","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L807","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54682f6-914e-4c16-b8fb-63b5dcb14933?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103915","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:32.653","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"melograno","product":"Booking for Appointments and Events Calendar – Amelia","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/ameliabooking.php#L1220","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/src/Application/Commands/Booking/Event/GetEventsCommandHandler.php#L401","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/src/Application/Commands/Booking/Event/GetEventsCommandHandler.php#L72","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.4.11/src/Application/Controller/Booking/Event/GetEventsController.php#L29","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25571e59-c966-4d30-9453-42b63778b9a0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109367","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:32.793","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers to extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"smub","product":"All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Meta/Helpers.php#L95","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Meta/Title.php#L116","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1214","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1393","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L1494","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/5.0.3/app/Common/Utils/Tags.php#L965","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3760115/all-in-one-seo-pack/trunk/app/Common/Utils/Tags.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75510022-382c-4d03-9c59-1d06349e72bb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110530","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:32.933","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"radgeek","product":"FeedWordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2026.0517","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:01.156723Z","id":"CVE-2026-110530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/feedwordpress/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L1196","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L1726","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L395","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.1016/syndicatedpost.class.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad2334c-21f5-40bc-8b08-32c12ce1e077?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118235","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:33.620","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpazleen","product":"SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.10.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:32:52.989686Z","id":"CVE-2026-118235","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.svn.wordpress.org/simple-form/trunk/","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L67","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L973","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L988","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L118","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L137","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3770697/simple-form/trunk/app/FileUpload.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aac2178-f6ce-4444-9afc-7e014547cd48?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119160","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:33.760","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown — a standard filter interaction requiring no elevated privileges from the victim."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"shapedplugin","product":"Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.0.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:10.225719Z","id":"CVE-2026-119160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/post-carousel/tags/4.0.8/blocks/assets/js/script.js#L1744","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-carousel/tags/4.0.8/blocks/includes/class-template-part.php#L1130","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-carousel/tags/4.0.8/blocks/includes/class-template-part.php#L1146","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3775298/post-carousel","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3775298/post-carousel/trunk/blocks/assets/js/script.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5612c16-9629-4869-8ec1-8fba788b7d7c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-120075","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T09:16:33.897","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"melapress","product":"WP Activity Log","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.6.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:34:07.354690Z","id":"CVE-2026-120075","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3496481%40wp-security-audit-log&new=3496481%40wp-security-audit-log","source":"security@wordfence.com"},{"url":"https://research.cleantalk.org/CVE-2026-120075","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c201b563-1195-45b8-adf9-c8aeccb8ce0e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-100151","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:29.037","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This bypass is triggered when an attacker supplies a matching field:&lt;key&gt; URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kstover","product":"Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.15.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:33:54.649429Z","id":"CVE-2026-100151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/assets/js/min/front-end.js","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/MergeTags/Other.php#L41","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Templates/fields-html.html#L2","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/assets/js/min/front-end.js","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/ninja-forms/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ace2e3-1120-4be9-a7c6-b64590c8a35f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104926","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:36.273","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source and requires no prior knowledge to discover."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ThemeHigh","product":"WooCommerce Extra Product Options Pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:30:57.282220Z","id":"CVE-2026-104926","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.themehigh.com/product/woocommerce-extra-product-options/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7199a4e-5811-4860-911b-b5d3fda24e16?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107711","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:37.370","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's admin_enqueue_scripts callback exposes the REST bearer token in the Dashboard page source via wp_localize_script() without a capability check, and the REST endpoint's permission_callback validates only that bearer token rather than performing a current_user_can() capability check."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wppool","product":"FlexStock – Product Stock Sync with Google Sheets for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.17.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:33:50.078364Z","id":"CVE-2026-107711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-api.php#L577","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-api.php#L79","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-app.php#L458","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-hooks.php#L1184","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/helper/functions.php#L139","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/models/class-product.php#L1500","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3768111/stock-sync-with-google-sheet-for-woocommerce/trunk/includes/models/class-product.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03cabc6-1cbe-4aa2-8eae-cea30d01b811?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109231","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:37.660","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when \"Disable login for unactivated customers\" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have double opt-in enabled with \"Disable login for unactivated customers\" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"vendidero","product":"Germanized for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-841"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L127","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L687","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L88","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L915","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3743210%40woocommerce-germanized&new=3743210%40woocommerce-germanized","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b661e8d7-c50e-4cbf-86a8-3e44d7b61871?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-116752","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:37.793","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"paoltaia","product":"GeoDirectory – WP Business Directory Plugin and Classified Listings Directory","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:33:58.839379Z","id":"CVE-2026-116752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/AyeCode/geodirectory/archive/refs/heads/master.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/assets/aui/js/geodirectory-plupload.js#L363","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/includes/class-geodir-media.php#L1264","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/includes/class-geodir-post-data.php#L329","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.197/templates/bootstrap/file-upload.php#L44","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3768833/geodirectory/trunk/assets/aui/js/geodirectory-plupload.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/197252d7-3098-43cd-b680-3d857ddb29ba?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-120114","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:38.183","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted dlmVars.jsErrorLogging nonce — which is broadcast on every frontend page — to pass the nonce check on the unauthenticated endpoint."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"qriouslad","product":"Debug Log Manager – Conveniently Monitor and Inspect Errors","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:33:52.320068Z","id":"CVE-2026-120114","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L134","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L567","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1605","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1728","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L2158","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L519","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3754121%40debug-log-manager&new=3754121%40debug-log-manager","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904181bc-fd56-4296-9c59-532bbc272abd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-76010","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:38.547","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"smub","product":"Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:34:08.237352Z","id":"CVE-2026-76010","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L1226","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2373","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2951","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DynamicThumbnails/Controller.php#L33","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L289","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L69","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3699076/nextgen-gallery/trunk/src/DataStorage/Manager.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96554","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T10:16:38.927","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the \"Enable social group creation by all members\" setting to be enabled, which is the default and permits Subscriber-level users to create groups; exploitation is not possible if group creation is restricted to administrators."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"Boss Media","product":"BuddyBoss Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:33:56.695157Z","id":"CVE-2026-96554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://buddyboss.com/resources/buddyboss-platform-releases/3-7-0/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f79f27-e577-4e1c-886f-bdb38cdc5600?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15272","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T12:16:27.790","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Because the parameter is used in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping provides no protection against time-based payloads such as SLEEP-based conditionals."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"Shamalli","product":"Web 2.0 Directory plugin for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.10.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:30:52.036922Z","id":"CVE-2026-15272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://codecanyon.net/item/web-20-directory-plugin-for-wordpress/6463373","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/317e155b-5d7b-447b-93db-65b5f242a66d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-78188","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-31T15:16:53.860","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.\n\nWebDyne::Session sets its session cookie with only a name, value and path.\n\nBrowsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"WebDyne","modules":["WebDyne"],"programFiles":["lib/WebDyne/Session.pm"],"programRoutines":[{"name":"WebDyne::Session::handler"}],"repo":"https://github.com/aspeer/WebDyne","packageURL":"pkg:cpan/WebDyne","versions":[{"version":"2.014","lessThan":"3.022","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-614"},{"lang":"en","value":"CWE-1004"},{"lang":"en","value":"CWE-1275"}]}],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-78189","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-31T15:16:54.003","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.\n\nWhen a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes.\n\nA remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"WebDyne","modules":["WebDyne"],"programFiles":["lib/WebDyne/PSGI.pm"],"programRoutines":[{"name":"WebDyne::PSGI::api_filename"}],"repo":"https://github.com/aspeer/WebDyne","packageURL":"pkg:cpan/WebDyne","versions":[{"version":"3.007","lessThan":"3.022","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-78190","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-31T15:16:54.123","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting.\n\nThe textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect.\n\nA remote attacker can inject script into any page using these tags through a crafted link."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"WebDyne","modules":["WebDyne"],"programFiles":["lib/WebDyne.pm","lib/WebDyne/HTML/Tiny.pm"],"programRoutines":[{"name":"WebDyne::HTML::Tiny::entity_encode"}],"repo":"https://github.com/aspeer/WebDyne","packageURL":"pkg:cpan/WebDyne","versions":[{"version":"2.014","lessThan":"3.022","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-78191","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-31T15:16:54.247","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages.\n\nWebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor.\n\nAn application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"WebDyne","modules":["WebDyne"],"programFiles":["lib/WebDyne/Constant.pm","lib/WebDyne/Request/PAGI.pm","lib/WebDyne/Request/PSGI.pm"],"repo":"https://github.com/aspeer/WebDyne","packageURL":"pkg:cpan/WebDyne","versions":[{"version":"2.031","lessThan":"3.022","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-777"}]}],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-78192","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-31T15:16:54.367","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page.\n\nWebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files.\n\nA remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"WebDyne","modules":["WebDyne"],"programFiles":["bin/webdyne.apache","bin/webdyne.pagi","bin/webdyne.psgi","lib/WebDyne/index.psp"],"repo":"https://github.com/aspeer/WebDyne","packageURL":"pkg:cpan/WebDyne","versions":[{"version":"2.022","lessThan":"3.022","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-540"},{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://metacpan.org/release/ASPEER/WebDyne-3.022/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-120185","sourceIdentifier":"cna@vuldb.com","published":"2026-10-31T23:17:11.423","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ken678","product":"YznCMS","cpes":["cpe:2.3:a:yzncms:yzncms:*:*:*:*:*:*:*:*"],"modules":["Auth Group Handler"],"versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"affected"},{"version":"2.2.0","status":"affected"},{"version":"2.2.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:38:42.410773Z","id":"CVE-2026-120185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://gitee.com/ken678/YZNCMS/","source":"cna@vuldb.com"},{"url":"https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d","source":"cna@vuldb.com"},{"url":"https://gitee.com/ken678/YZNCMS/tree/v2.2.1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120185","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1026603","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429502","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429502/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120189","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T01:17:16.877","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"D-Link","product":"DIR-505","cpes":["cpe:2.3:h:d-link:dir-505:*:*:*:*:*:*:*:*"],"modules":["TFTP Upload Filename Handler"],"versions":[{"version":"1.10B02","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/Walnut1337/DIR-505_filename_rce/tree/main/poc","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120189","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1027185","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429528","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429528/cti","source":"cna@vuldb.com"},{"url":"https://www.dlink.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120190","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T01:17:17.133","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the component Submission Description Editor. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.1.76 addresses this issue. The patch is identified as 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4. It is advisable to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"PostyBirb Plus","cpes":["cpe:2.3:a:postybirb_plus:postybirb_plus:*:*:*:*:*:*:*:*"],"modules":["Submission Description Editor"],"versions":[{"version":"3.1.0","status":"affected"},{"version":"3.1.1","status":"affected"},{"version":"3.1.2","status":"affected"},{"version":"3.1.3","status":"affected"},{"version":"3.1.4","status":"affected"},{"version":"3.1.5","status":"affected"},{"version":"3.1.6","status":"affected"},{"version":"3.1.7","status":"affected"},{"version":"3.1.8","status":"affected"},{"version":"3.1.9","status":"affected"},{"version":"3.1.10","status":"affected"},{"version":"3.1.11","status":"affected"},{"version":"3.1.12","status":"affected"},{"version":"3.1.13","status":"affected"},{"version":"3.1.14","status":"affected"},{"version":"3.1.15","status":"affected"},{"version":"3.1.16","status":"affected"},{"version":"3.1.17","status":"affected"},{"version":"3.1.18","status":"affected"},{"version":"3.1.19","status":"affected"},{"version":"3.1.20","status":"affected"},{"version":"3.1.21","status":"affected"},{"version":"3.1.22","status":"affected"},{"version":"3.1.23","status":"affected"},{"version":"3.1.24","status":"affected"},{"version":"3.1.25","status":"affected"},{"version":"3.1.26","status":"affected"},{"version":"3.1.27","status":"affected"},{"version":"3.1.28","status":"affected"},{"version":"3.1.29","status":"affected"},{"version":"3.1.30","status":"affected"},{"version":"3.1.31","status":"affected"},{"version":"3.1.32","status":"affected"},{"version":"3.1.33","status":"affected"},{"version":"3.1.34","status":"affected"},{"version":"3.1.35","status":"affected"},{"version":"3.1.36","status":"affected"},{"version":"3.1.37","status":"affected"},{"version":"3.1.38","status":"affected"},{"version":"3.1.39","status":"affected"},{"version":"3.1.40","status":"affected"},{"version":"3.1.41","status":"affected"},{"version":"3.1.42","status":"affected"},{"version":"3.1.43","status":"affected"},{"version":"3.1.44","status":"affected"},{"version":"3.1.45","status":"affected"},{"version":"3.1.46","status":"affected"},{"version":"3.1.47","status":"affected"},{"version":"3.1.48","status":"affected"},{"version":"3.1.49","status":"affected"},{"version":"3.1.50","status":"affected"},{"version":"3.1.51","status":"affected"},{"version":"3.1.52","status":"affected"},{"version":"3.1.53","status":"affected"},{"version":"3.1.54","status":"affected"},{"version":"3.1.55","status":"affected"},{"version":"3.1.56","status":"affected"},{"version":"3.1.57","status":"affected"},{"version":"3.1.58","status":"affected"},{"version":"3.1.59","status":"affected"},{"version":"3.1.60","status":"affected"},{"version":"3.1.61","status":"affected"},{"version":"3.1.62","status":"affected"},{"version":"3.1.63","status":"affected"},{"version":"3.1.64","status":"affected"},{"version":"3.1.65","status":"affected"},{"version":"3.1.66","status":"affected"},{"version":"3.1.67","status":"affected"},{"version":"3.1.68","status":"affected"},{"version":"3.1.69","status":"affected"},{"version":"3.1.70","status":"affected"},{"version":"3.1.71","status":"affected"},{"version":"3.1.72","status":"affected"},{"version":"3.1.73","status":"affected"},{"version":"3.1.74","status":"affected"},{"version":"3.1.75","status":"affected"},{"version":"3.1.76","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/mvdicarlo/postybirb-plus/commit/6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4","source":"cna@vuldb.com"},{"url":"https://github.com/mvdicarlo/postybirb-plus/issues/504","source":"cna@vuldb.com"},{"url":"https://github.com/mvdicarlo/postybirb-plus/pull/506","source":"cna@vuldb.com"},{"url":"https://github.com/mvdicarlo/postybirb-plus/releases/tag/v3.1.76","source":"cna@vuldb.com"},{"url":"https://github.com/user-attachments/files/32685547/report.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120190","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1027356","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429529","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429529/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120191","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T01:17:17.383","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Presenton","cpes":["cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*"],"modules":["API"],"versions":[{"version":"0.9.11-beta","status":"affected"},{"version":"0.9.12-beta","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/presenton/presenton/","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/issues/972","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/pull/980","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/releases/tag/v0.9.12-beta","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120191","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1027384","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429530","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429530/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120249","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-01T01:17:18.683","lastModified":"2026-11-02T16:17:31.903","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Thelia","product":"Thelia Back-office Default Twig Template","defaultStatus":"unaffected","repo":"https://github.com/thelia-templates/default-twig","packageURL":"pkg:composer/thelia/backoffice-default-twig-template","versions":[{"version":"0","lessThan":"1.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:52:48.339138Z","id":"CVE-2026-120249","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Catalog/ProductAdvancedController.php#L546-L599","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093aa58a3064d4412bd3","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thelia-templates/default-twig/commit/aaf540ca552dbc4c63dca77620af4b7936d22e8f","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thelia/thelia/security/advisories/GHSA-j2c3-9c4q-c2ch","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/thelia-back-office-default-twig-template-before-1.1.1-csrf-via-product-combination-routes","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thelia/thelia/security/advisories/GHSA-j2c3-9c4q-c2ch","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-120192","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T02:16:59.980","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Presenton","cpes":["cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*"],"modules":["Desktop Authentication Middleware"],"versions":[{"version":"0.9.11-beta","status":"affected"},{"version":"0.9.12-beta","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:40:34.648686Z","id":"CVE-2026-120192","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/presenton/presenton/","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/issues/973","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/pull/980","source":"cna@vuldb.com"},{"url":"https://github.com/presenton/presenton/releases/tag/v0.9.12-beta","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120192","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1027385","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429531","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429531/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120195","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T04:18:46.687","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WL-WN579A3-A","cpes":["cpe:2.3:a:wavlink:wl-wn579a3-a:*:*:*:*:*:*:*:*"],"modules":["Initial Setup Wizard"],"versions":[{"version":"2026-03-10-94f93d4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN579A3_CVE_wzdgwMesh_wlan_ssid.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120195","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914922","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429558","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429558/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120196","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T04:18:46.943","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN579X3-D","cpes":["cpe:2.3:a:wavlink:wn579x3-d:*:*:*:*:*:*:*:*"],"versions":[{"version":"V250402","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120196","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/916941","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429559","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429559/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120197","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T04:18:47.147","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WL-WN530HG4B","cpes":["cpe:2.3:a:wavlink:wl-wn530hg4b:*:*:*:*:*:*:*:*"],"versions":[{"version":"M_V260724","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120197","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/917074","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429560","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429560/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-107343","sourceIdentifier":"contact@wpscan.com","published":"2026-11-01T05:18:56.843","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Kali Forms — Contact Form & Drag-and-Drop Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.30","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:26:21.200287Z","id":"CVE-2026-107343","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/75a86686-ce21-4ba6-bf39-74aacf5ca4a9/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113481","sourceIdentifier":"contact@wpscan.com","published":"2026-11-01T05:18:57.110","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.44","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:26:13.473991Z","id":"CVE-2026-113481","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7b11d80d-1e90-4437-b5a5-483e8fd345d7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113482","sourceIdentifier":"contact@wpscan.com","published":"2026-11-01T05:18:57.247","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.44","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:26:03.733858Z","id":"CVE-2026-113482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b01e935e-94ea-4993-8e49-2882f594bd54/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118168","sourceIdentifier":"contact@wpscan.com","published":"2026-11-01T05:18:57.360","lastModified":"2026-11-02T16:20:09.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MapPress  WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MapPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.97.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:25:38.483408Z","id":"CVE-2026-118168","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ce9f0060-1054-41ca-9543-1508547aab27/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-120198","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T05:18:57.620","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WL-WN530BE1-A","cpes":["cpe:2.3:a:wavlink:wl-wn530be1-a:*:*:*:*:*:*:*:*"],"versions":[{"version":"V251117","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:20:05.950832Z","id":"CVE-2026-120198","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WN530BE1.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120198","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/918551","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429561","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429561/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120217","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T07:17:14.487","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Delgan","product":"loguru","cpes":["cpe:2.3:a:delgan:loguru:*:*:*:*:*:*:*:*"],"modules":["ANSI Color-Markup Parser"],"versions":[{"version":"0.7.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-120217","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992264","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429568","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429568/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120223","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T10:18:37.230","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Oray","product":"Pugongying X5 Pro","cpes":["cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"],"modules":["Session ID Handler"],"versions":[{"version":"7.6.0","status":"affected"},{"version":"7.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:P/I:N/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-330"}]}],"references":[{"url":"https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Predictable-Session-ID-Exposes-an-Ordinary-User-s-Password-3eb797159f158043b197d098224fc12f","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120223","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007539","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429582","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429582/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120224","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T11:18:57.437","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Oray","product":"Pugongying X5 Pro","cpes":["cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"],"modules":["API Authorization"],"versions":[{"version":"7.6.0","status":"affected"},{"version":"7.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:20:59.358631Z","id":"CVE-2026-120224","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120224","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007541","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007542","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429583","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429583/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120225","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T11:18:57.843","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Oray","product":"Pugongying X5 Pro","cpes":["cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"],"versions":[{"version":"7.6.0","status":"affected"},{"version":"7.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:C/I:C/A:C","baseScore":8.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-23"}]}],"references":[{"url":"https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Configuration-Restore-Filename-Traversal-Leads-to-Root-Code-Execution-3eb797159f158017a2cbe1732b7ffa6c","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120225","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007547","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007550","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007551","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429584","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429584/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120226","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T12:17:09.640","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Hangzhou Xiongmai Technology","product":"P2PAPI.dll","cpes":["cpe:2.3:a:hangzhou_xiongmai_technology:p2papi.dll:*:*:*:*:*:*:*:*"],"modules":["P2P SDK"],"versions":[{"version":"1.3.3.32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:N/I:N/A:P","baseScore":1.7,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"LOW","exploitabilityScore":3.1,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://gist.github.com/Ishanoshada/a47d24d77dd03f34c7f324491b59edac","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120226","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1013929","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429585","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429585/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120227","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T13:18:00.643","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN701AE","cpes":["cpe:2.3:o:wavlink:wn701ae_firmware:*:*:*:*:*:*:*:*"],"modules":["ioos Web Backend"],"versions":[{"version":"M01AE_V260105","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN701AE.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120227","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/918620","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429586","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429586/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120228","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T14:18:52.883","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN553X1-B","cpes":["cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*"],"modules":["ioos Service"],"versions":[{"version":"V260403_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:32:15.537851Z","id":"CVE-2026-120228","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK%20WN553X1-B%20Router.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120228","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919151","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429587","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429587/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120229","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T14:18:53.123","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN553X1-B","cpes":["cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*"],"versions":[{"version":"260403_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:C/I:C/A:C","baseScore":8.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120229","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919153","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429588","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429588/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120230","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T15:17:22.830","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN701AE","cpes":["cpe:2.3:o:wavlink:wn701ae_firmware:*:*:*:*:*:*:*:*"],"modules":["ioos Web Backend"],"versions":[{"version":"260105","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120230","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919242","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429589","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429589/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120231","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T15:17:23.053","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN553X1-B","cpes":["cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*"],"modules":["OpenVPN CLI Handler"],"versions":[{"version":"V260403_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_openvpn_cli_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120231","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919247","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429590","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429590/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120232","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T15:17:23.263","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Horizon DataSys","product":"Reboot Restore Standard","cpes":["cpe:2.3:a:horizon_datasys:reboot_restore_standard:*:*:*:*:*:*:*:*"],"modules":["Kernel Driver"],"versions":[{"version":"13.0","status":"affected"},{"version":"13.1","status":"affected"},{"version":"13.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:C/I:C/A:C","baseScore":6.8,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":3.1,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:31:44.961575Z","id":"CVE-2026-120232","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://gist.github.com/Element2023H/a176865b1f4015e003620154f3ba103c","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120232","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1001497","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429591","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429591/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-119480","sourceIdentifier":"audit@patchstack.com","published":"2026-11-01T16:18:13.513","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetFormBuilder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"jetformbuilder","versions":[{"version":"0","lessThanOrEqual":"3.6.7.1","versionType":"custom","status":"affected","changes":[{"at":"3.6.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:22:16.500395Z","id":"CVE-2026-119480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-7-1-arbitrary-file-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-120233","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T16:18:14.290","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ag-ui-protocol","product":"ag-ui","cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"modules":["HttpAgent"],"versions":[{"version":"0.0.1","status":"affected"},{"version":"0.0.2","status":"affected"},{"version":"0.0.3","status":"affected"},{"version":"0.0.4","status":"affected"},{"version":"0.0.5","status":"affected"},{"version":"0.0.6","status":"affected"},{"version":"0.0.7","status":"affected"},{"version":"0.0.8","status":"affected"},{"version":"0.0.9","status":"affected"},{"version":"0.0.10","status":"affected"},{"version":"0.0.11","status":"affected"},{"version":"0.0.12","status":"affected"},{"version":"0.0.13","status":"affected"},{"version":"0.0.14","status":"affected"},{"version":"0.0.15","status":"affected"},{"version":"0.0.16","status":"affected"},{"version":"0.0.17","status":"affected"},{"version":"0.0.18","status":"affected"},{"version":"0.0.19","status":"affected"},{"version":"0.0.20","status":"affected"},{"version":"0.0.21","status":"affected"},{"version":"0.0.22","status":"affected"},{"version":"0.0.23","status":"affected"},{"version":"0.0.24","status":"affected"},{"version":"0.0.25","status":"affected"},{"version":"0.0.26","status":"affected"},{"version":"0.0.27","status":"affected"},{"version":"0.0.28","status":"affected"},{"version":"0.0.29","status":"affected"},{"version":"0.0.30","status":"affected"},{"version":"0.0.31","status":"affected"},{"version":"0.0.32","status":"affected"},{"version":"0.0.33","status":"affected"},{"version":"0.0.34","status":"affected"},{"version":"0.0.35","status":"affected"},{"version":"0.0.36","status":"affected"},{"version":"0.0.37","status":"affected"},{"version":"0.0.38","status":"affected"},{"version":"0.0.39","status":"affected"},{"version":"0.0.40","status":"affected"},{"version":"0.0.41","status":"affected"},{"version":"0.0.42","status":"affected"},{"version":"0.0.43","status":"affected"},{"version":"0.0.44","status":"affected"},{"version":"0.0.45","status":"affected"},{"version":"0.0.46","status":"affected"},{"version":"0.0.47","status":"affected"},{"version":"0.0.48","status":"affected"},{"version":"0.0.49","status":"affected"},{"version":"0.0.50","status":"affected"},{"version":"0.0.51","status":"affected"},{"version":"0.0.52","status":"affected"},{"version":"0.0.53","status":"affected"},{"version":"0.0.54","status":"affected"},{"version":"0.0.55","status":"affected"},{"version":"0.0.56","status":"affected"},{"version":"0.0.57","status":"affected"},{"version":"0.0.58","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2520","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120233","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015143","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429592","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429592/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120234","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T16:18:14.530","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ag-ui-protocol","product":"ag-ui","cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"modules":["HTTP Transport"],"versions":[{"version":"0.0.1","status":"affected"},{"version":"0.0.2","status":"affected"},{"version":"0.0.3","status":"affected"},{"version":"0.0.4","status":"affected"},{"version":"0.0.5","status":"affected"},{"version":"0.0.6","status":"affected"},{"version":"0.0.7","status":"affected"},{"version":"0.0.8","status":"affected"},{"version":"0.0.9","status":"affected"},{"version":"0.0.10","status":"affected"},{"version":"0.0.11","status":"affected"},{"version":"0.0.12","status":"affected"},{"version":"0.0.13","status":"affected"},{"version":"0.0.14","status":"affected"},{"version":"0.0.15","status":"affected"},{"version":"0.0.16","status":"affected"},{"version":"0.0.17","status":"affected"},{"version":"0.0.18","status":"affected"},{"version":"0.0.19","status":"affected"},{"version":"0.0.20","status":"affected"},{"version":"0.0.21","status":"affected"},{"version":"0.0.22","status":"affected"},{"version":"0.0.23","status":"affected"},{"version":"0.0.24","status":"affected"},{"version":"0.0.25","status":"affected"},{"version":"0.0.26","status":"affected"},{"version":"0.0.27","status":"affected"},{"version":"0.0.28","status":"affected"},{"version":"0.0.29","status":"affected"},{"version":"0.0.30","status":"affected"},{"version":"0.0.31","status":"affected"},{"version":"0.0.32","status":"affected"},{"version":"0.0.33","status":"affected"},{"version":"0.0.34","status":"affected"},{"version":"0.0.35","status":"affected"},{"version":"0.0.36","status":"affected"},{"version":"0.0.37","status":"affected"},{"version":"0.0.38","status":"affected"},{"version":"0.0.39","status":"affected"},{"version":"0.0.40","status":"affected"},{"version":"0.0.41","status":"affected"},{"version":"0.0.42","status":"affected"},{"version":"0.0.43","status":"affected"},{"version":"0.0.44","status":"affected"},{"version":"0.0.45","status":"affected"},{"version":"0.0.46","status":"affected"},{"version":"0.0.47","status":"affected"},{"version":"0.0.48","status":"affected"},{"version":"0.0.49","status":"affected"},{"version":"0.0.50","status":"affected"},{"version":"0.0.51","status":"affected"},{"version":"0.0.52","status":"affected"},{"version":"0.0.53","status":"affected"},{"version":"0.0.54","status":"affected"},{"version":"0.0.55","status":"affected"},{"version":"0.0.56","status":"affected"},{"version":"0.0.57","status":"affected"},{"version":"0.0.58","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-404"}]}],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2521","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2698","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120234","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015146","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429593","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429593/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120235","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T16:18:14.757","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ag-ui-protocol","product":"ag-ui","cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"modules":["SSE Parser"],"versions":[{"version":"0.0.1","status":"affected"},{"version":"0.0.2","status":"affected"},{"version":"0.0.3","status":"affected"},{"version":"0.0.4","status":"affected"},{"version":"0.0.5","status":"affected"},{"version":"0.0.6","status":"affected"},{"version":"0.0.7","status":"affected"},{"version":"0.0.8","status":"affected"},{"version":"0.0.9","status":"affected"},{"version":"0.0.10","status":"affected"},{"version":"0.0.11","status":"affected"},{"version":"0.0.12","status":"affected"},{"version":"0.0.13","status":"affected"},{"version":"0.0.14","status":"affected"},{"version":"0.0.15","status":"affected"},{"version":"0.0.16","status":"affected"},{"version":"0.0.17","status":"affected"},{"version":"0.0.18","status":"affected"},{"version":"0.0.19","status":"affected"},{"version":"0.0.20","status":"affected"},{"version":"0.0.21","status":"affected"},{"version":"0.0.22","status":"affected"},{"version":"0.0.23","status":"affected"},{"version":"0.0.24","status":"affected"},{"version":"0.0.25","status":"affected"},{"version":"0.0.26","status":"affected"},{"version":"0.0.27","status":"affected"},{"version":"0.0.28","status":"affected"},{"version":"0.0.29","status":"affected"},{"version":"0.0.30","status":"affected"},{"version":"0.0.31","status":"affected"},{"version":"0.0.32","status":"affected"},{"version":"0.0.33","status":"affected"},{"version":"0.0.34","status":"affected"},{"version":"0.0.35","status":"affected"},{"version":"0.0.36","status":"affected"},{"version":"0.0.37","status":"affected"},{"version":"0.0.38","status":"affected"},{"version":"0.0.39","status":"affected"},{"version":"0.0.40","status":"affected"},{"version":"0.0.41","status":"affected"},{"version":"0.0.42","status":"affected"},{"version":"0.0.43","status":"affected"},{"version":"0.0.44","status":"affected"},{"version":"0.0.45","status":"affected"},{"version":"0.0.46","status":"affected"},{"version":"0.0.47","status":"affected"},{"version":"0.0.48","status":"affected"},{"version":"0.0.49","status":"affected"},{"version":"0.0.50","status":"affected"},{"version":"0.0.51","status":"affected"},{"version":"0.0.52","status":"affected"},{"version":"0.0.53","status":"affected"},{"version":"0.0.54","status":"affected"},{"version":"0.0.55","status":"affected"},{"version":"0.0.56","status":"affected"},{"version":"0.0.57","status":"affected"},{"version":"0.0.58","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-404"}]}],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/commit/9e7b2b00bce215bbf731f1e6094f63812527c432","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2522","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2627","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120235","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015147","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429594","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429594/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-62048","sourceIdentifier":"audit@patchstack.com","published":"2026-11-01T16:18:15.170","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"BookIt","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"bookit","versions":[{"version":"0","lessThanOrEqual":"2.6.0.6","versionType":"custom","status":"affected","changes":[{"at":"2.6.0.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:22:12.995899Z","id":"CVE-2026-62048","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-66570","sourceIdentifier":"audit@patchstack.com","published":"2026-11-01T16:18:15.323","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nickboss","product":"WordPress File Upload","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-file-upload","versions":[{"version":"0","lessThanOrEqual":"5.2.1","versionType":"custom","status":"affected","changes":[{"at":"5.2.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-01T17:22:21.161085Z","id":"CVE-2026-66570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-120236","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T17:16:33.393","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ag-ui-protocol","product":"ag-ui","cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"modules":["Transport Decoder Handler"],"versions":[{"version":"0.0.1","status":"affected"},{"version":"0.0.2","status":"affected"},{"version":"0.0.3","status":"affected"},{"version":"0.0.4","status":"affected"},{"version":"0.0.5","status":"affected"},{"version":"0.0.6","status":"affected"},{"version":"0.0.7","status":"affected"},{"version":"0.0.8","status":"affected"},{"version":"0.0.9","status":"affected"},{"version":"0.0.10","status":"affected"},{"version":"0.0.11","status":"affected"},{"version":"0.0.12","status":"affected"},{"version":"0.0.13","status":"affected"},{"version":"0.0.14","status":"affected"},{"version":"0.0.15","status":"affected"},{"version":"0.0.16","status":"affected"},{"version":"0.0.17","status":"affected"},{"version":"0.0.18","status":"affected"},{"version":"0.0.19","status":"affected"},{"version":"0.0.20","status":"affected"},{"version":"0.0.21","status":"affected"},{"version":"0.0.22","status":"affected"},{"version":"0.0.23","status":"affected"},{"version":"0.0.24","status":"affected"},{"version":"0.0.25","status":"affected"},{"version":"0.0.26","status":"affected"},{"version":"0.0.27","status":"affected"},{"version":"0.0.28","status":"affected"},{"version":"0.0.29","status":"affected"},{"version":"0.0.30","status":"affected"},{"version":"0.0.31","status":"affected"},{"version":"0.0.32","status":"affected"},{"version":"0.0.33","status":"affected"},{"version":"0.0.34","status":"affected"},{"version":"0.0.35","status":"affected"},{"version":"0.0.36","status":"affected"},{"version":"0.0.37","status":"affected"},{"version":"0.0.38","status":"affected"},{"version":"0.0.39","status":"affected"},{"version":"0.0.40","status":"affected"},{"version":"0.0.41","status":"affected"},{"version":"0.0.42","status":"affected"},{"version":"0.0.43","status":"affected"},{"version":"0.0.44","status":"affected"},{"version":"0.0.45","status":"affected"},{"version":"0.0.46","status":"affected"},{"version":"0.0.47","status":"affected"},{"version":"0.0.48","status":"affected"},{"version":"0.0.49","status":"affected"},{"version":"0.0.50","status":"affected"},{"version":"0.0.51","status":"affected"},{"version":"0.0.52","status":"affected"},{"version":"0.0.53","status":"affected"},{"version":"0.0.54","status":"affected"},{"version":"0.0.55","status":"affected"},{"version":"0.0.56","status":"affected"},{"version":"0.0.57","status":"affected"},{"version":"0.0.58","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:30:58.450312Z","id":"CVE-2026-120236","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/commit/660182b973a44b8eda5484b14b88eb9cc251edc4","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2524","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2774","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120236","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015178","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429595","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429595/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120237","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T18:17:13.497","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ag-ui-protocol","product":"ag-ui","cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"modules":["Interrupt expiry"],"versions":[{"version":"0.0.1","status":"affected"},{"version":"0.0.2","status":"affected"},{"version":"0.0.3","status":"affected"},{"version":"0.0.4","status":"affected"},{"version":"0.0.5","status":"affected"},{"version":"0.0.6","status":"affected"},{"version":"0.0.7","status":"affected"},{"version":"0.0.8","status":"affected"},{"version":"0.0.9","status":"affected"},{"version":"0.0.10","status":"affected"},{"version":"0.0.11","status":"affected"},{"version":"0.0.12","status":"affected"},{"version":"0.0.13","status":"affected"},{"version":"0.0.14","status":"affected"},{"version":"0.0.15","status":"affected"},{"version":"0.0.16","status":"affected"},{"version":"0.0.17","status":"affected"},{"version":"0.0.18","status":"affected"},{"version":"0.0.19","status":"affected"},{"version":"0.0.20","status":"affected"},{"version":"0.0.21","status":"affected"},{"version":"0.0.22","status":"affected"},{"version":"0.0.23","status":"affected"},{"version":"0.0.24","status":"affected"},{"version":"0.0.25","status":"affected"},{"version":"0.0.26","status":"affected"},{"version":"0.0.27","status":"affected"},{"version":"0.0.28","status":"affected"},{"version":"0.0.29","status":"affected"},{"version":"0.0.30","status":"affected"},{"version":"0.0.31","status":"affected"},{"version":"0.0.32","status":"affected"},{"version":"0.0.33","status":"affected"},{"version":"0.0.34","status":"affected"},{"version":"0.0.35","status":"affected"},{"version":"0.0.36","status":"affected"},{"version":"0.0.37","status":"affected"},{"version":"0.0.38","status":"affected"},{"version":"0.0.39","status":"affected"},{"version":"0.0.40","status":"affected"},{"version":"0.0.41","status":"affected"},{"version":"0.0.42","status":"affected"},{"version":"0.0.43","status":"affected"},{"version":"0.0.44","status":"affected"},{"version":"0.0.45","status":"affected"},{"version":"0.0.46","status":"affected"},{"version":"0.0.47","status":"affected"},{"version":"0.0.48","status":"affected"},{"version":"0.0.49","status":"affected"},{"version":"0.0.50","status":"affected"},{"version":"0.0.51","status":"affected"},{"version":"0.0.52","status":"affected"},{"version":"0.0.53","status":"affected"},{"version":"0.0.54","status":"affected"},{"version":"0.0.55","status":"affected"},{"version":"0.0.56","status":"affected"},{"version":"0.0.57","status":"affected"},{"version":"0.0.58","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-404"}]}],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2525","source":"cna@vuldb.com"},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/3241","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120237","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015179","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429596","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429596/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120238","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T18:17:13.720","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN553X1-B","cpes":["cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*"],"modules":["ovpn_file Handler"],"versions":[{"version":"260403_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120238","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919248","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429597","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429597/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120239","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T18:17:13.920","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN553X1-B","cpes":["cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*"],"modules":["WireGuard CLI Handler"],"versions":[{"version":"V260403_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120239","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919250","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429598","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429598/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120240","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T19:16:57.950","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN553X1-B","cpes":["cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*"],"modules":["WireGuard CLI Group Handler"],"versions":[{"version":"V260403_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:30:20.112203Z","id":"CVE-2026-120240","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_group_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120240","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919251","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429599","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429599/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120241","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T19:16:59.393","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Ruijie","product":"RG-ES205GC","cpes":["cpe:2.3:a:ruijie:rg-es205gc:*:*:*:*:*:*:*:*"],"modules":["Local Firmware Upgrade Interface"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES206GC-P","cpes":["cpe:2.3:a:ruijie:rg-es206gc-p:*:*:*:*:*:*:*:*"],"modules":["Local Firmware Upgrade Interface"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES208GC","cpes":["cpe:2.3:a:ruijie:rg-es208gc:*:*:*:*:*:*:*:*"],"modules":["Local Firmware Upgrade Interface"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES210GC-LP","cpes":["cpe:2.3:a:ruijie:rg-es210gc-lp:*:*:*:*:*:*:*:*"],"modules":["Local Firmware Upgrade Interface"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES210GS-P","cpes":["cpe:2.3:a:ruijie:rg-es210gs-p:*:*:*:*:*:*:*:*"],"modules":["Local Firmware Upgrade Interface"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:C","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_PreAuth_Boundary_Overflow_DoS","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120241","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016041","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429600","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429600/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120242","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T19:16:59.583","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Ruijie","product":"RG-ES205GC","cpes":["cpe:2.3:a:ruijie:rg-es205gc:*:*:*:*:*:*:*:*"],"modules":["Cloud Management"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES206GC-P","cpes":["cpe:2.3:a:ruijie:rg-es206gc-p:*:*:*:*:*:*:*:*"],"modules":["Cloud Management"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES208GC","cpes":["cpe:2.3:a:ruijie:rg-es208gc:*:*:*:*:*:*:*:*"],"modules":["Cloud Management"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES210GC-LP","cpes":["cpe:2.3:a:ruijie:rg-es210gc-lp:*:*:*:*:*:*:*:*"],"modules":["Cloud Management"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]},{"vendor":"Ruijie","product":"RG-ES210GS-P","cpes":["cpe:2.3:a:ruijie:rg-es210gs-p:*:*:*:*:*:*:*:*"],"modules":["Cloud Management"],"versions":[{"version":"ESW_1.0(1)B1P48","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N","baseScore":3.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_XSS","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120242","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016042","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429601","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429601/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-82115","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:46.777","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect.\n\nA caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource's callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller's own connection.\n\nAn application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource's callbacks do with a text or binary message of the caller's choosing. The connection is registered under the caller's own session, so it gives no access to another user's connection.\n\nAs a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 7.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-native-websocket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-native-websocket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://lists.apache.org/thread.html/0lj9og7vp22ps77nrwdj42f64cfb9g4c","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82557","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:46.990","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in Form#onRequest() and passes the result directly to Form#onFormSubmitted(IFormSubmitter). The check that the submitting component is visible and enabled in its hierarchy runs only when onFormSubmitted() is given no submitter, so it no longer runs for an ordinary form submission, and it is the only point at which Wicket verifies that the application actually offered the named control to the caller. Form#findSubmitter() matches on the request parameter name alone and applies no visibility or enablement filter, and the request handler checks only the form itself, which is visible and enabled. A request that names a submit button the application withheld therefore reaches that button's onSubmit() and onAfterSubmit(), and its onError() when form validation fails; where the button sets setDefaultFormProcessing(false) it reaches onSubmit() and onAfterSubmit() without any form validation.\n\nAn application is affected where a form submitting component, such as a Button or a SubmitLink, is unavailable to the caller while the enclosing form remains available. How the component was made unavailable does not matter: the component's own setVisible(false), setEnabled(false) or setVisibilityAllowed(false), an overridden isVisible() or isEnabled(), an invisible or disabled parent container anywhere above it, and a RENDER or ENABLE denial from IAuthorizationStrategy — for example through MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation — are all enforced by that one check, and all of them are bypassed. A component that renders as disabled carries its own input name in the markup the caller already holds. Submissions made through AjaxFormSubmitBehavior, and therefore through AjaxButton and AjaxSubmitLink, are not affected: those are invoked as a behaviour on the button itself, the behaviour's invocation is authorized against that button, and the non-Ajax callbacks of those two classes do nothing. Restrictions applied to the form or to the page rather than to the submitting component are unaffected.\n\nThe 9.x and 8.x release lines, and the unsupported lines before them, are not affected; the behaviour was introduced in 10.3.0.\n\nThis issue affects Apache Wicket: from 10.3.0 through 10.11.0. Users are recommended to upgrade to version 10.12.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"10.3.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://lists.apache.org/thread.html/lz4jot6f9ycxfjyhmlr2b4ssynmgpy92","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82558","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:47.187","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused.\n\nAn application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-native-websocket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-native-websocket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://lists.apache.org/thread.html/o1ojfn53742ztd13m93336t3kdjw2tq9","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82559","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:47.370","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient session expiration in Apache Wicket.\n\norg.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every frame that arrives on it. Copying the request is deliberate and is documented as such, because the container recycles the upgrade request once the handshake is over. The container session is copied along with it, into an org.apache.wicket.protocol.ws.api.HttpSessionCopy holding the session attributes as they stood when the connection was opened. That second copy is not necessary, because a session, unlike a request, is not discarded at the end of a request. Every frame afterwards resolves its Wicket session through ISessionStore#lookup(), which reads it out of the copy, so the connection is detached from the live container session for as long as it stays open.\n\nEnding the session through the container therefore does not end the connection. After an idle timeout, an HttpSession#invalidate() call made from a filter or from a security framework, a container-managed logout, or a session replacement, the connection goes on resolving the org.apache.wicket.Session instance that existed when it was opened, together with that session's attributes and, for applications built on wicket-auth-roles, the signed-in state held on that same instance, so an authorization decision taken inside a WebSocket callback is taken against an identity that has already been revoked. The copy is also what the connection writes through: a Session#invalidateNow() issued from inside a WebSocket callback invalidates the copy and leaves the container session valid, and session attributes set over the connection are written to the copy rather than to the session.\n\nAn application is affected where it uses Wicket's native WebSocket support on pages or shared resources that require an authenticated session, and where sessions are ended by the container rather than by Wicket. Session#invalidateNow(), and AuthenticatedWebSession#invalidate() and #signOut() which call it, remain effective for a WebSocketBehavior on a page: they clear the page manager, and the connection can then no longer resolve the page it was opened for. A WebSocketResource is not limited in that way, because a frame naming a resource is served against a throwaway page and never consults the page manager, so such a connection outlives Wicket's own sign-out as well. Some containers close WebSocket connections themselves when the HTTP session they were opened under is destroyed, in which case the connection ends regardless; that is a property of the container rather than of Wicket. Applications that do not use the native WebSocket support are not affected.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-native-websocket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-native-websocket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://lists.apache.org/thread.html/5vkw9wz6gf135ccosj928zjs4hqy7bcv","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82704","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:47.583","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.Component#canCallListener() allows it, and that method is isEnabledInHierarchy() && isVisibleInHierarchy(). The visibility half reads a flag that carries the outcome of IAuthorizationStrategy#isActionAuthorized() for the Component.RENDER action, and that flag is written in one place only, Component#configure(), during the render phase. A listener URL built by a subclass of org.apache.wicket.core.request.mapper.AbstractBookmarkableMapper carries the page identifier and the component path in a single parameter, and the page identifier may be empty. When it is, a new page instance is constructed, PageProvider#wasExpired() is false because no identifier was supplied, and PageAndComponentProvider#getComponent() finds the component directly on the new instance, so neither a render pass nor Component#configure() runs before the listener is invoked. The flag therefore still holds its constructor default, the component counts as visible, and the listener of a component the authorization strategy denied RENDER for is executed. The same request also skips Component#onConfigure(), so visibility and enablement an application sets there are not applied either.\n\nThere are two ways to reach this, and neither requires anything but a request. On a page that is stateful, the caller omits the page identifier from a listener URL that would otherwise carry it. On a page that Wicket considers stateless, nothing has to be altered at all: Wicket itself writes listener URLs without a page identifier for such pages, and a component the strategy denies RENDER for is treated as stateless and therefore does not keep the page stateful, so denying RENDER can itself produce the page-id-less form. The second route has never been refused. The ENABLE decision of IAuthorizationStrategy is consulted on every invocation and still refuses, as does a request that supplies the real identifier of a page instance that has already been rendered; a component the application disabled in Component#onConfigure() is protected by neither, because that callback has not run.\n\nAn application is affected where it withholds an individual component from the caller, either by denying the RENDER action through IAuthorizationStrategy, including through the MetaDataRoleAuthorizationStrategy and AuthorizeAction facilities of wicket-auth-roles, or by setting the component's visibility or enabled flag in Component#onConfigure(), the callback Wicket's own documentation directs applications to use for both. The page carrying such a component has to be constructible from a bookmarkable or mounted URL, which requires a public constructor taking either no arguments or a PageParameters argument. Behaviours pass through the same gate, so an AJAX behaviour attached to such a component is equally exposed. Separately, and whether or not any component is withheld, a listener on a page Wicket considers stateful is invoked on an instance the request itself constructed, so it acts on models built from page parameters the caller supplied rather than on the state the application last rendered. Instantiation authorization is unaffected: IAuthorizationStrategy#isInstantiationAuthorized() is still consulted when the new page instance is created, so a guard placed on the page rather than on the individual component continues to hold.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://lists.apache.org/thread.html/yrtov7vfmj7c7wl7j1tt0dsv2t0zwy9b","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82705","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:47.820","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized(), and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource reached through a mounted or shared ResourceReference. Components that are handed an org.apache.wicket.request.resource.IResource instance instead call IResource#respond() themselves from their own request listener and never construct that handler. In wicket-core these are org.apache.wicket.markup.html.link.ResourceLink, org.apache.wicket.markup.html.image.Image and org.apache.wicket.markup.html.form.ImageButton; in wicket-extensions it is org.apache.wicket.extensions.ajax.AjaxDownloadBehavior. A resource restricted by a custom isResourceAuthorized() implementation, or by an @AuthorizeResource annotation from wicket-auth-roles, is therefore enforced when it is requested through its own resource URL and is not enforced when the same instance is served through the component that holds it.\n\nWhich of the two happens is decided by the constructor the application used, and not by anything the application can see in the rendered page. ResourceLink(String, ResourceReference) renders a resource URL and the request is authorized; ResourceLink(String, IResource) renders a component listener URL and it is not. Image, ImageButton and AjaxDownloadBehavior each offer the same pair of constructors and behave the same way. Image and ImageButton write that listener URL into the src attribute of the tag they render, so a browser requests it without any action by the user, and the resource an Image serves may also come from the component's model.\n\nAn application is affected where it restricts a resource through IAuthorizationStrategy#isResourceAuthorized() or an @AuthorizeResource annotation and then hands that same resource to one of those components as an IResource. An application that does not restrict resources at all is not affected, and neither is a resource that is only mounted or registered as a shared resource. The pattern does not have to be written by the application itself: org.apache.wicket.extensions.markup.html.repeater.data.table.export.ExportToolbar builds each of its export links from an IResource instance, so the exported contents of a data table are served without the resource check in any application that adds that toolbar.\n\nAs a workaround, register the resource in the application's shared resources and pass the resulting ResourceReference to the component instead of the IResource, so that the request is routed through the handler that consults the authorization strategy.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://lists.apache.org/thread.html/t9y3sho3wkqkr1vsf74xn8tzmgdr1tgo","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82840","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:48.017","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Session fixation in Apache Wicket.\n\norg.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an application authenticates a session. Renewing the container session id at that point is the standard defence against an attacker who has fixed a session id in a victim's browser, and Wicket provides that renewal as org.apache.wicket.Session#changeSessionId(), whose documentation directs callers to invoke it on login for exactly that reason.\n\nAuthenticatedWebSession#signIn(String, String) calls it inside a guard that succeeds only on the first transition of the session's signed-in flag. The session id is therefore renewed when a session first signs in, and is not renewed when a session that is already signed in authenticates again. signIn(String, String) returns true either way, so neither the caller nor the application can tell that the renewal did not happen.\n\nAn application is affected where it authenticates through AuthenticatedWebSession, which AuthenticatedWebApplication requires and which the shipped UsernamePasswordPanel uses, and where a session that is already signed in can authenticate again: a step-up prompt before a sensitive action, an account switch, or simply a sign-in form that stays reachable once the user is signed in. Nothing in the module hides that form from a signed-in session. Reaching the defect also requires an attacker to place a session id of their choosing in the victim's browser. JSESSIONID is set by the servlet container rather than by Wicket, so that needs a position Wicket does not grant, such as control of a host under the same registrable domain or a container configured to carry the session id in the URL, and the planted session has to be one the attacker has already signed in on, because a session that is not yet signed in does have its id renewed by the victim's authentication. An authentication attempt that fails signs the session out and closes the window. Applications that renew the session id in their own code after a successful authentication are not affected.\n\nAs a workaround, renew the session id from the application's own code on every successful authentication, by calling Session#changeSessionId() at the end of the authenticate(String, String) implementation.\n\nThis issue affects Apache Wicket: from 8.18.0 through 8.19.0, from 9.23.0 through 9.24.0, from 10.9.0 through 10.11.0.\n\nUsers are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-auth-roles","packageURL":"pkg:maven/org.apache.wicket/wicket-auth-roles","versions":[{"version":"8.18.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.23.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.9.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-384"}]}],"references":[{"url":"https://lists.apache.org/thread.html/q812kjb74x2pt6956w0pcmkc4wwj95l9","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-82898","sourceIdentifier":"security@apache.org","published":"2026-11-01T22:17:48.217","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect order of security checks in Apache Wicket.\n\norg.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obtaining the page instantiates it, and instantiating a page runs the configured org.apache.wicket.authorization.IAuthorizationStrategy. An application that refuses an unauthenticated visitor by throwing org.apache.wicket.RestartResponseAtInterceptPageException therefore throws it from inside the isolation listener, before any policy has run. That exception replaces the request handler, so the policies are never consulted and a request that came from another origin is not refused.\n\nThe exception's constructor stores the URL of the request it interrupted, so that Component#continueToOriginalDestination() can resume it once the visitor has signed in. The stored URL is the one the policies would have refused. On sign in Wicket redirects to it, and that redirect is same-origin, so the policies allow it and the listener runs in the newly authenticated session. The whole URL is stored, its query string included, so an ordinary org.apache.wicket.markup.html.form.Form is resumed with the field values the original request carried in its query string and Form#onSubmit() runs with values another origin chose. A form POST is not needed for this; a plain top-level navigation carries them.\n\nAn application is affected where it registers ResourceIsolationRequestCycleListener, which is opt-in and is not registered by default, and where it refuses unauthorized access with RestartResponseAtInterceptPageException followed by continueToOriginalDestination(). No application override is involved on that path: IAuthorizationStrategy#isInstantiationAuthorized() documents throwing that exception, org.apache.wicket.authroles.authentication.AuthenticatedWebApplication throws it and org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel continues to the original destination, and org.apache.wicket.authorization.strategies.page.SimplePageAuthorizationStrategy in wicket-core installs the same pattern. A visitor who is already signed in is not affected, because no interception occurs. Request-body parameters stored alongside the intercepted URL are not applied to the resumed form: the resumption is a redirect, so the resumed request is a GET, and form components read their values from the query string on a GET.\n\nAs a workaround, refuse unauthorized access with org.apache.wicket.RestartResponseException instead, which does not store the original destination; visitors are then not returned to the page they asked for after signing in.\n\nThis issue affects Apache Wicket: from 9.1.0 through 9.24.0, from 10.0.0 through 10.11.0.\n\nReleases before 9.1.0, which is every 8.x release and 9.0.0, are not affected, because the resource isolation this issue concerns was introduced in 9.1.0. They are not protected either. Their only cross-origin defence is org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener, which works out where a request came from by reading its Origin header and falling back to its Referer header. Neither header need arrive: a browser does not send Origin on the plain GET a link uses, and the document on the other origin decides through its own referrer policy whether a Referer reaches the application at all. That mechanism therefore never made the guarantee the Fetch Metadata based policy makes, and on those releases a listener invocation from another origin is not reliably refused in the first place. Anyone on a release before 9.1.0 who wants this protection should upgrade to 9.x or 10.x and register ResourceIsolationRequestCycleListener.\n\nUsers are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"9.1.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-696"}]}],"references":[{"url":"https://lists.apache.org/thread.html/bm4mlwsgftxfg345zvdqj0skg1mktpyp","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-111089","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:28.697","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads.\n\nA resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script.\n\nIn org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. It does prevent an inline event handler injected through the attribute cases.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://lists.apache.org/thread.html/xyp4sm5mm7s618fktstb22577qxbmqw8","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-120275","sourceIdentifier":"cna@vuldb.com","published":"2026-11-01T23:17:28.900","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Shanghai Xi Yu Ji Zhi Technology","product":"Minimax Code","cpes":["cpe:2.3:a:shanghai_xi_yu_ji_zhi_technology:minimax_code:*:*:*:*:*:*:*:*"],"modules":["Find Command Handler"],"versions":[{"version":"0.5.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:29:40.458866Z","id":"CVE-2026-120275","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://mcniyfj5bw9b.feishu.cn/docx/RenxdtY52oBlqRxN4S7csZtNnUc","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120275","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1007426","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429619","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429619/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-82956","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:29.130","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the request parameter windowName, and remembers what the browser reported in a field of the behaviour. That field is part of the page's serialized state, so the remembered value stays in the page store for as long as the page instance does.\n\nOn every later render of that page instance the behaviour builds the precondition of its Ajax call by substituting the remembered value into a single-quoted JavaScript string literal, and Wicket writes that precondition into the page as raw JavaScript, because the precondition of an Ajax call listener is script supplied by the caller and is emitted without quoting or escaping. Nothing on that path escapes the value. The window name is client-supplied and Wicket applies no validation to it, so a remembered name containing a single quote ends the literal and the rest of it runs as script in the application's origin, every time that page instance is rendered.\n\nAn application is affected only where it has explicitly added AjaxNewWindowNotifyingBehavior to a component. No part of the framework installs the behaviour, so an application that does not use it is not affected. The name the behaviour generates for itself, when the browser reports no name at all, is a random UUID and is not client-supplied.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0.\n\nUsers are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://lists.apache.org/thread.html/fs3vdddt9bwshdstj952psj49s5w4vqm","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-83539","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:29.317","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe.\n\nAn application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected.\n\nOn 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default policy and not of these components. An application that has weakened or disabled its Content-Security-Policy, for this or for any unrelated reason, is affected in full. Wicket 8.x has no Content-Security-Policy support at all and is affected as it stands.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-extensions","packageURL":"pkg:maven/org.apache.wicket/wicket-extensions","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://lists.apache.org/thread.html/xqdymd8g178sc112lmqbp53zlss53cwz","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-83559","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:29.513","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper encoding or escaping of output in Apache Wicket.\n\norg.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a JavaScript string literal. It does not escape the backslash, which is the character that has to be escaped, and escaped first, for the rest of that escaping to hold. A value that already holds a backslash immediately before a quote therefore ends up with two backslashes in front of that quote: the first escapes the second, the quote itself is left unescaped, and it closes the literal. Whatever the value carries after that point is no longer text but JavaScript, and it runs in the application's origin and in the session of the user looking at the page. The method is public, is not deprecated, and its documentation states that its result can be part of a JavaScript call such as an alert; the only limitation it notes concerns JSON values, which need different escaping.\n\nAn application is affected wherever it calls the method itself and places the result inside a JavaScript string literal, from its own code or from a component of its own or of a third party, and the value it escapes holds data an attacker can influence. There is no further condition, and no component of Wicket has to be involved: the application is using the method for what its documentation offers, and the method does not deliver it.\n\nTwo components shipped with Wicket Extensions pass a value through the method. org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the editor's first error feedback message into a single-quoted JavaScript string literal in the Ajax response, so an application is affected through that component where the message shown for a failed edit holds data an attacker can influence, whether that is the submitted value itself or another variable the application sets on the validation error. A validation message can carry the submitted value, because input is a message variable that every form component supplies for its own validation errors, and the documentation shows overriding a validator's message to include it; none of the message bundles shipped with Wicket interpolates it, so an application that has not written such a message is not affected through this component. org.apache.wicket.extensions.ajax.markup.html.repeater.AjaxListPanel passes the serialized markup tag of an appended component through the method and is not affected: the tag comes from the panel's own markup file, and a quote in any of its attribute values, the component's markup id included, is written as a character reference by the tag serialization and cannot close the literal.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.\n\nUsers are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://lists.apache.org/thread.html/77kc85ztkxdpp7wg7cv61c4539j9s1g3","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-83594","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:29.723","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Memory allocation with an excessive size value in Apache Wicket.\n\norg.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback reads the request parameter filesInfo, a JSON array carrying a client file name, a size and a content type for each file, and turns it into the list of FileUploadToResourceField.UploadInfo that onUploadSuccess() receives. Nothing binds that JSON to an upload the resource performed and nothing re-derives it from the stored files, so the number of entries and every value in them are whatever the request supplied. The callback URL is rendered into the page, no prior upload is required, and both GET and POST reach it, so any client that can load the page can have the component report files that were never uploaded, without authenticating beyond whatever the page itself requires and without any user interaction.\n\nUploadInfo#get(), which the class offers as the way to obtain the bytes of an upload, allocates a byte array from UploadInfo#getSize() before it opens the file. The array is therefore sized by the number the request supplied, and the allocation happens even for a file that was never stored. One small request can cost the server close to two gigabytes of heap, and the request is trivially repeatable, so a few of them exhaust the heap for every request the Java virtual machine is serving. A size that the conversion to int turns negative instead throws NegativeArraySizeException, which the exception handler inside that method does not cover, so it escapes into the application.\n\nAn application is affected where it uses FileUploadToResourceField, which is not the ordinary upload path through FileUploadField and Form and has to be extended and mounted deliberately. The allocation additionally requires the application to call UploadInfo#get() rather than reading UploadInfo#getFile() itself. Where the application denies the ENABLE action on the field through its authorization strategy, the callback is refused like any other listener. The 8.x line does not contain this component and is not affected.\n\nThis issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"9.14.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://lists.apache.org/thread.html/h5lxspxg746pzjd437n3n7mq5t3sfbcb","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-84170","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:29.913","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling in Apache Wicket.\n\norg.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource rather than through a Form. The resource is an application-wide singleton with no component to consult, so newResourceResponse() takes the three limits that bound the upload - the total request size, the maximum size of a single part and the maximum number of parts - from the request parameters maxSize, fileMaxSize and fileCountMax, and hands them to the multipart parser as they arrive. Nothing binds those numbers to the field that is supposed to be uploading. A request naming a very large maxSize is therefore parsed with no effective ceiling on the total size, and omitting fileMaxSize and fileCountMax leaves the per-part and part-count limits unset as well. The values the application configured through FileUploadToResourceField#setMaxSize(), #setFileMaxSize() and #setFileCountMax() are consulted only when the client omits the corresponding parameter, so against a client that supplies one they have no effect at all.\n\nParts above the parser's in-memory threshold are spooled to the container's temporary directory, and the file parts are then copied into the folder the application's IUploadsFileManager owns, under a sub-folder the request names, where they remain. A part that is not a file is read into the heap in full while the request is parsed. One request, repeatable, can therefore consume as much disk or as much heap as the client chooses to send. The resource carries no authorization annotation and the default authorization strategy permits every resource request, so unless the application authorizes the resource itself the request needs no authentication, no session, no prior page view and no user interaction.\n\nAn application is affected where it uses FileUploadToResourceField, or mounts FileUploadResourceReference itself. This is not the ordinary upload path: the resource is a singleton that has to be created and mounted deliberately. An application that configures no upload limit at all loses nothing, because Wicket applies no total-size limit of its own by default; what the defect removes is a limit the application set. Uploads through Form with FileUploadField, and through AjaxFileDropBehavior, are not affected, because both read their limits from the component rather than from the request. The upload resource does not exist in the 8.x line.\n\nThis issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.9.1. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"9.14.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://lists.apache.org/thread.html/bw3hn5cch3q7yrsl05m8mvmgyx4m98y7","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-84172","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:30.113","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Files accessible to external parties in Apache Wicket.\n\norg.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component's markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application's IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class' own loader, the context class loader, and the wicket-core loader last.\n\nWhere wicket-core is loaded by a class loader that cannot see the application's classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component's markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.\n\nSuch a deployment is rare. The ordinary packaging, a web archive with wicket-core in WEB-INF/lib, puts the framework and the application in one class loader, so the check finds the class file and the template is refused; those deployments are not affected. The exposure is confined to deployments that give wicket-core a class loader which cannot see the application's component classes: wicket-core placed in a servlet container's shared library directory, in an enterprise archive library directory with the application in the web archive, as an application server global module, or as an OSGi bundle, where wicket-core's bundle cannot resolve a class held by an application bundle. Markup shipped by Wicket's own modules, and by any other code sharing a class loader with wicket-core, remains protected. An attacker has to name a component class, and Wicket writes fully qualified class names into the URL of every package resource it renders.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://lists.apache.org/thread.html/90mlx42q7nkdccdby1ql1ksl4sxy13x6","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-84177","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:30.317","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it.\n\norg.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the request URL, and then hands that same path to the resource stream locator together with a style, a variation and a locale. Those three attributes are decoded from the name of the first query parameter and never appear in the string the guard was given. org.apache.wicket.core.util.resource.locator.ResourceNameIterator appends them to that path, each preceded by an underscore, in the order variation, style, locale, before the file extension, so the file that is opened is not the file the guard approved.\n\norg.apache.wicket.markup.html.PackageResourceGuard decides whether an HTML file is a component's markup template by looking for a class file of the same name beside it, stripping one underscore-delimited suffix at a time as it goes. HTML is on the default allow list, so that check is the only thing separating a static HTML file, which may be served, from a markup template, which may not. Asked about the name of a template, the guard refuses it correctly. Asked about a shorter name for which no class exists, it accepts, and a style supplied in the URL then completes that name into the markup template of a component class, which is written to the response.\n\nAn application is affected if the simple name of any of its component classes contains an underscore and no shorter part of that name is itself a class, such as Report_v2 or Wizard_Step1; an application with no such class name is not affected. No unusual deployment, packaging or configuration is required, and running in deployment rather than development mode does not prevent it. Java naming conventions discourage underscores in class names and no module Wicket ships has one, so no framework markup is exposed; what an application exposes this way is its own. A component whose class name has no underscore is not reachable, and neither is its localized or styled markup, because the guard finds the class file under the base name and refuses the request. The attributes cannot change the file extension and cannot leave the component's package, so nothing beyond HTML files in that package is reachable. Access is read-only, and what is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. No user data, credential or session material is reachable this way. An attacker has to name a class in the target package and the component itself, and Wicket writes fully qualified class names into the URL of every package resource it renders.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-179"}]}],"references":[{"url":"https://lists.apache.org/thread.html/hy089v60t5v36skpnbry96vr2427lw0o","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-84231","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:30.550","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin.\n\nAn application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.\n\nUsers are recommended to upgrade to version 8.20.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://lists.apache.org/thread.html/39kz9838w25797bpkxn1hvfsm8jtc4zv","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-87718","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:30.727","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Users are recommended to upgrade to version 10.12.0 or 9.25.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.10.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-693"}]}],"references":[{"url":"https://lists.apache.org/thread.html/fjq8v35zpkbtjwpzwkkpzocwtdgokp1m","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-95863","sourceIdentifier":"security@apache.org","published":"2026-11-01T23:17:30.943","lastModified":"2026-11-02T16:13:27.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation in Apache Wicket.\n\nApache Wicket generates JavaScript that refers to the elements it renders, and\nwrites into that JavaScript two values it derives itself: a component's markup\nid, and the input name of a form component, which is built from component ids.\nBoth are placed inside single-quoted JavaScript string literals without being\nescaped for that context, so a value containing a single quote or a backslash\nends the literal, and what follows is parsed as script and runs in the\napplication's origin when the page loads.\n\nA markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),\nor the id attribute written in the component's markup, or an id Wicket\ngenerates, in that order. The first two are supplied by the application in an\nHTML context, where both characters are legal and where Wicket escapes them\ncorrectly when it writes the same value into the id attribute of the element; a\ngenerated id cannot contain either. An input name is derived from the ids of the\ncomponents between the form and the form component, and a component id was\nrejected only for ':' and '~'.\n\nIn org.apache.wicket:wicket-core on 9.x and 10.x,\norg.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,\nCharSequence) quotes the id it is given into a Wicket.Event.add call, and\ncomponents in both wicket-core and wicket-extensions reach it through\n#forComponent(Component, String, CharSequence). On every affected version,\norg.apache.wicket.markup.html.form.Form writes its markup id and the id of its\nhidden-fields container into such literals,\norg.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input\nname, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes\ntwo markup ids and an input name. On 8.x, Form also writes an input name into the\naction of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField\nwrites an input name into a name attribute with no escaping at all, so a value\ncontaining a double quote escapes the attribute into markup.\n\norg.apache.wicket:wicket-extensions is affected in its own right and not only\nthrough wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,\nAjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,\nFilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build\ntheir own JavaScript containing a markup id.\n\nAn application is affected where a markup id or a component id carries one of\nthose characters. Wicket does not put one there itself, so the value comes from\nthe application: an id set on a component, an id attribute in a template, or a\ncomponent id derived from data. None of those is a JavaScript context from the\napplication's point of view.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does\nnot prevent this. The generated script is written into a script element carrying\nthe per-response nonce, so the injected code is part of a script the policy\nadmits.\n\nThe fixed versions check an id where it enters instead of escaping each place it\nis written. A component id and a markup id may no longer contain a quote, a\nbackquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a\ncontrol character, and a markup id may not contain parentheses or square\nbrackets either; a component constructed with such an id, or given such a markup\nid, fails with an exception.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through\n9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which\nare no longer supported, should upgrade to a supported version. Users are\nrecommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Wicket","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wicket:wicket-core","packageURL":"pkg:maven/org.apache.wicket/wicket-core","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.0","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.24.0","versionType":"semver","status":"affected"},{"version":"10.0.0","lessThanOrEqual":"10.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-120276","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T00:18:09.897","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"modules":["Web Management Interface"],"versions":[{"version":"V260507_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_openvpn_cli_group_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120276","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919502","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429620","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429620/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120277","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T00:18:10.810","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"modules":["WireGuard CLI Group Handler"],"versions":[{"version":"V260507_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_wireguard_cli_group_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120277","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919503","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429621","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429621/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120278","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T00:18:11.003","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"modules":["VPN Client List Handler"],"versions":[{"version":"V260507_2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_vpn_list_info_disclosure.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120278","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919506","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429622","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429622/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120279","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T01:17:26.677","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"modules":["openvpn_cli Handler"],"versions":[{"version":"V260507","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:28:42.685378Z","id":"CVE-2026-120279","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120279","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919788","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429623","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429623/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120280","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T01:17:26.873","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"modules":["WireGuard"],"versions":[{"version":"V260507","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120280","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919789","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429624","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429624/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120281","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T01:17:27.070","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"modules":["OpenVPN Handler"],"versions":[{"version":"V260507","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120281","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919790","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429625","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429625/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120282","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T01:17:27.293","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN536AX6-A","cpes":["cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*"],"versions":[{"version":"V260507","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120282","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919791","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429626","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429626/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120283","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T01:17:27.500","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Linksys","product":"E8450","cpes":["cpe:2.3:o:linksys:e8450_firmware:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.2.00.360516","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:23:45.555931Z","id":"CVE-2026-120283","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-120283","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1014924","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429627","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429627/cti","source":"cna@vuldb.com"},{"url":"https://www.linksys.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120322","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T02:18:47.550","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","cpes":["cpe:2.3:a:termix-ssh:termix:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.9.0","status":"affected"},{"version":"2.9.1","status":"affected"},{"version":"2.9.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120322","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015028","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429654","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429654/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120324","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T03:17:30.157","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Aklivity","product":"Zilla","cpes":["cpe:2.3:a:aklivity:zilla:*:*:*:*:*:*:*:*"],"modules":["http-filesystem Binding"],"versions":[{"version":"1.3.0","status":"affected"},{"version":"1.3.1","status":"affected"},{"version":"1.3.2","status":"affected"},{"version":"1.3.3","status":"affected"},{"version":"1.3.4","status":"affected"},{"version":"2.4.0","status":"affected"},{"version":"2.4.1","status":"affected"},{"version":"2.4.2","status":"affected"},{"version":"2.4.3","status":"affected"},{"version":"2.4.4","status":"affected"},{"version":"2.4.5","status":"affected"},{"version":"2.4.6","status":"affected"},{"version":"2.4.7","status":"affected"},{"version":"2.5.0-rc1","status":"affected"},{"version":"2.5.0-rc2","status":"affected"},{"version":"2.5.0-rc3","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.7}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/0xGenesi/CVE/blob/main/Zilla_Http_Filesystem_Binding_Path_Traversal.md","source":"cna@vuldb.com"},{"url":"https://github.com/aklivity/zilla/","source":"cna@vuldb.com"},{"url":"https://github.com/aklivity/zilla/commit/46a8b15cbea157f7ae8b7cb865809a02fd6b1988","source":"cna@vuldb.com"},{"url":"https://github.com/aklivity/zilla/pull/2623","source":"cna@vuldb.com"},{"url":"https://github.com/aklivity/zilla/releases/tag/2.5.0-rc3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120324","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015032","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429656","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429656/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120325","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T03:17:30.410","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Webpro-nl","product":"Knip","cpes":["cpe:2.3:a:webpro-nl:knip:*:*:*:*:*:*:*:*"],"modules":["Workspace Handler"],"versions":[{"version":"6.0","status":"affected"},{"version":"6.1","status":"affected"},{"version":"6.2","status":"affected"},{"version":"6.3","status":"affected"},{"version":"6.4","status":"affected"},{"version":"6.5","status":"affected"},{"version":"6.6","status":"affected"},{"version":"6.7","status":"affected"},{"version":"6.8","status":"affected"},{"version":"6.9","status":"affected"},{"version":"6.10","status":"affected"},{"version":"6.11","status":"affected"},{"version":"6.12","status":"affected"},{"version":"6.13","status":"affected"},{"version":"6.14","status":"affected"},{"version":"6.15","status":"affected"},{"version":"6.16","status":"affected"},{"version":"6.17","status":"affected"},{"version":"6.18","status":"affected"},{"version":"6.19","status":"affected"},{"version":"6.20","status":"affected"},{"version":"6.21","status":"affected"},{"version":"6.22","status":"affected"},{"version":"6.23","status":"affected"},{"version":"6.24","status":"affected"},{"version":"6.25","status":"affected"},{"version":"6.26","status":"affected"},{"version":"6.27","status":"affected"},{"version":"6.28","status":"affected"},{"version":"6.29","status":"affected"},{"version":"6.30","status":"affected"},{"version":"6.31","status":"affected"},{"version":"6.32","status":"affected"},{"version":"6.33","status":"affected"},{"version":"6.34","status":"affected"},{"version":"6.35","status":"affected"},{"version":"6.36","status":"affected"},{"version":"6.37","status":"affected"},{"version":"6.38","status":"affected"},{"version":"6.39","status":"affected"},{"version":"6.40","status":"affected"},{"version":"6.41","status":"affected"},{"version":"6.42","status":"affected"},{"version":"6.43","status":"affected"},{"version":"6.44.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120325","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1015033","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429657","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429657/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120334","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T03:17:30.630","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"cna@vuldb.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"deepset-ai","product":"farm","cpes":["cpe:2.3:a:deepset-ai:farm:*:*:*:*:*:*:*:*"],"modules":["Tokenizer Loader"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_FARM_Tokenizer_Load_via_Attacker-Controlled_vocab_filename.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120334","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016276","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429659","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429659/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120335","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T03:17:30.873","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"cna@vuldb.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"deepset-ai","product":"farm","cpes":["cpe:2.3:a:deepset-ai:farm:*:*:*:*:*:*:*:*"],"modules":["Model Package Loader"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":0.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P","baseScore":4.3,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.1,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:18:23.386065Z","id":"CVE-2026-120335","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_FARM_WordEmbedding_LM_Model_Package_Loading.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120335","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016279","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429660","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429660/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-20499","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:31.090","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982VB","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:59.498896Z","id":"CVE-2026-20499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20545","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:31.257","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:56.322179Z","id":"CVE-2026-20545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20546","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:31.390","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:52.936444Z","id":"CVE-2026-20546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20547","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:31.523","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:50.493560Z","id":"CVE-2026-20547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20548","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:31.650","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:47.968266Z","id":"CVE-2026-20548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20549","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:31.780","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:45.642555Z","id":"CVE-2026-20549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20555","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:32.557","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876664; Issue ID: MSV-9834."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:42.888639Z","id":"CVE-2026-20555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20556","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:32.697","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:40.042901Z","id":"CVE-2026-20556","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20557","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:32.823","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:07:36.705548Z","id":"CVE-2026-20557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20560","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:33.190","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870543; Issue ID: MSV-9070."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:39.946069Z","id":"CVE-2026-20560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20561","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:33.317","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01750090; Issue ID: MSV-8908."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:37.596988Z","id":"CVE-2026-20561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20562","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:33.450","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775984; Issue ID: MSV-8907."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:35.126667Z","id":"CVE-2026-20562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20563","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:33.583","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01777997; Issue ID: MSV-8905."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:32.667286Z","id":"CVE-2026-20563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20567","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.087","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-10004."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:33.097401Z","id":"CVE-2026-20567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20568","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.247","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:29.662880Z","id":"CVE-2026-20568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20569","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.390","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:26.558721Z","id":"CVE-2026-20569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20570","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.520","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:24.040502Z","id":"CVE-2026-20570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20571","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.640","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11434319; Issue ID: MSV-9925."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:21.326700Z","id":"CVE-2026-20571","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20572","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.767","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:18.903765Z","id":"CVE-2026-20572","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20573","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:34.893","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980D","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:16.670246Z","id":"CVE-2026-20573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20574","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:35.027","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980D","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8365","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:14.171135Z","id":"CVE-2026-20574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20575","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:35.150","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:10.630893Z","id":"CVE-2026-20575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20576","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:35.270","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6789","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:08.051981Z","id":"CVE-2026-20576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20578","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:35.527","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:30.443862Z","id":"CVE-2026-20578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-757"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20581","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:35.787","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6858","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8518S","status":"affected"},{"version":"MT8532","status":"affected"},{"version":"MT8668","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:04:01.202718Z","id":"CVE-2026-20581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20582","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:35.913","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8518S","status":"affected"},{"version":"MT8532","status":"affected"},{"version":"MT8668","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:03:59.002184Z","id":"CVE-2026-20582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20584","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:36.163","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:03:56.814414Z","id":"CVE-2026-20584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20585","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:36.283","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2718","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:06:35.194804Z","id":"CVE-2026-20585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20592","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:36.657","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01744265; Issue ID: MSV-9505."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:09:35.381389Z","id":"CVE-2026-20592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20593","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:36.790","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:28.204754Z","id":"CVE-2026-20593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20594","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:36.930","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:25.360887Z","id":"CVE-2026-20594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20595","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.053","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8321","status":"affected"},{"version":"MT8385","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8910","status":"affected"},{"version":"MT8911","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:03:54.483406Z","id":"CVE-2026-20595","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1286"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20596","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.187","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:22.701247Z","id":"CVE-2026-20596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20597","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.323","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:20.618099Z","id":"CVE-2026-20597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20598","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.500","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01755742; Issue ID: MSV-8896."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:00:17.358951Z","id":"CVE-2026-20598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20599","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.657","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:56:47.648626Z","id":"CVE-2026-20599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-280"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-20600","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.790","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:55:14.232269Z","id":"CVE-2026-20600","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-68588","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:37.950","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:54:11.769551Z","id":"CVE-2026-68588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-68589","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:38.087","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:53:18.346458Z","id":"CVE-2026-68589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-68590","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:38.213","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:47:53.654708Z","id":"CVE-2026-68590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-68591","sourceIdentifier":"security@mediatek.com","published":"2026-11-02T03:17:38.343","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:47:25.952604Z","id":"CVE-2026-68591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","source":"security@mediatek.com"}]}},{"cve":{"id":"CVE-2026-120336","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T04:16:53.033","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"VStarcam","product":"O-KAM Client","cpes":["cpe:2.3:a:vstarcam:o-kam_client:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.3.3.32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://gist.github.com/Ishanoshada/f6345a42a46e1345e6c7400aac311d77","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120336","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016301","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429661","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429661/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120337","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T04:16:53.237","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"VStarcam","product":"O-KAM SuperIPCam","cpes":["cpe:2.3:a:vstarcam:o-kam_superipcam:*:*:*:*:*:*:*:*"],"modules":["P2P Session Teardown"],"versions":[{"version":"1.3.3.32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120337","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016302","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429662","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429662/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120339","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T04:16:53.440","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"},{"version":"c46ce5736007d9d6e51a8feeb9250729fe85f139","status":"affected"},{"version":"dae0c5961a35a4faf28cde9e02117538f09f81c1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/updatedetailsfromfaculty-stored-xss.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120339","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016326","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429664","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429664/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120340","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T05:18:22.723","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"modules":["Global Session Handler"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"},{"version":"c46ce5736007d9d6e51a8feeb9250729fe85f139","status":"affected"},{"version":"dae0c5961a35a4faf28cde9e02117538f09f81c1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:19:03.441803Z","id":"CVE-2026-120340","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/session-cookie-logout.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120340","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016327","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429665","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429665/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120341","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T05:18:23.700","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"},{"version":"c46ce5736007d9d6e51a8feeb9250729fe85f139","status":"affected"},{"version":"dae0c5961a35a4faf28cde9e02117538f09f81c1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-698"},{"lang":"en","value":"CWE-705"}]}],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/details-plaintext-disclosure.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120341","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016328","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429666","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429666/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120342","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T05:18:24.310","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"},{"version":"c46ce5736007d9d6e51a8feeb9250729fe85f139","status":"affected"},{"version":"dae0c5961a35a4faf28cde9e02117538f09f81c1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/luan-oliveira01/Advisory-CloudClassroom-PHP-Project-1.0/tree/main/viewquery-sqli","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120342","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016422","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429667","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429667/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120343","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T05:18:24.860","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mathurvishal","product":"CloudClassroom-PHP-Project","cpes":["cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*"],"versions":[{"version":"5dadec098bfbbf3300d60c3494db3fb95b66e7be","status":"affected"},{"version":"c46ce5736007d9d6e51a8feeb9250729fe85f139","status":"affected"},{"version":"dae0c5961a35a4faf28cde9e02117538f09f81c1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120343","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1017562","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429668","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429668/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120344","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T05:18:25.450","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN551X3-A","cpes":["cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*"],"modules":["WireGuard CLI Group Handler"],"versions":[{"version":"M51X3_V251020-WO-182e965","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:08:19.457952Z","id":"CVE-2026-120344","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_wireguard_cli_group_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120344","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919551","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429669","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429669/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2024-5617","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","published":"2026-11-02T06:17:41.933","lastModified":"2026-11-02T16:22:25.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts."}],"affected":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","affectedData":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.0.0","versionType":"custom","status":"unknown"},{"version":"4.0.0","lessThan":"4.0.0.298","versionType":"custom","status":"affected"},{"version":"4.2.0","lessThan":"4.2.0.95","versionType":"custom","status":"affected"},{"version":"4.3.0","lessThan":"4.3.0.13","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.11.0","versionType":"custom","status":"unknown"},{"version":"5.11.0","lessThan":"5.11.0.348","versionType":"custom","status":"affected"},{"version":"6.0.0","lessThan":"6.0.0.194","versionType":"custom","status":"affected"},{"version":"6.1.0","lessThan":"6.1.0.162","versionType":"custom","status":"affected"},{"version":"7.0.0","lessThan":"7.0.0.33","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Management","defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.mgt","versions":[{"version":"5.18.187","lessThan":"5.18.187.259","versionType":"custom","status":"affected"},{"version":"5.23.8","lessThan":"5.23.8.180","versionType":"custom","status":"affected"},{"version":"5.24.8","lessThan":"5.24.8.5","versionType":"custom","status":"affected"},{"version":"5.25.92","lessThan":"5.25.92.84","versionType":"custom","status":"affected"},{"version":"5.25.705","lessThan":"5.25.705.5","versionType":"custom","status":"affected"},{"version":"7.0.78","lessThan":"7.0.78.19","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Carbon User Manager Kernel","defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.user.core","versions":[{"version":"4.6.1","lessThan":"4.6.1.114","versionType":"custom","status":"affected"},{"version":"4.7.1","lessThan":"4.7.1.53","versionType":"custom","status":"affected"},{"version":"4.8.1","lessThan":"4.8.1.16","versionType":"custom","status":"affected"},{"version":"4.9.0","lessThan":"4.9.0.58","versionType":"custom","status":"affected"},{"version":"4.9.26","lessThan":"4.9.26.7","versionType":"custom","status":"affected"},{"version":"4.10.9","lessThan":"4.10.9.17","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}]},"weaknesses":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","description":[{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}},{"cve":{"id":"CVE-2025-11969","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","published":"2026-11-02T06:17:42.087","lastModified":"2026-11-02T16:22:25.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability."}],"affected":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","affectedData":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0","versionType":"custom","status":"unknown"},{"version":"3.1.0","lessThan":"3.1.0.347","versionType":"custom","status":"affected"},{"version":"3.2.0","lessThan":"3.2.0.450","versionType":"custom","status":"affected"},{"version":"3.2.1","lessThan":"3.2.1.70","versionType":"custom","status":"affected"},{"version":"4.0.0","lessThan":"4.0.0.370","versionType":"custom","status":"affected"},{"version":"4.1.0","lessThan":"4.1.0.233","versionType":"custom","status":"affected"},{"version":"4.2.0","lessThan":"4.2.0.173","versionType":"custom","status":"affected"},{"version":"4.3.0","lessThan":"4.3.0.85","versionType":"custom","status":"affected"},{"version":"4.4.0","lessThan":"4.4.0.49","versionType":"custom","status":"affected"},{"version":"4.5.0","lessThan":"4.5.0.32","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.10.0","versionType":"custom","status":"unknown"},{"version":"5.10.0","lessThan":"5.10.0.367","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.0","versionType":"custom","status":"unknown"},{"version":"2.0.0","lessThan":"2.0.0.396","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.0","versionType":"custom","status":"unknown"},{"version":"2.0.0","lessThan":"2.0.0.416","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 API Control Plane","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.5.0","versionType":"custom","status":"unknown"},{"version":"4.5.0","lessThan":"4.5.0.33","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Universal Gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.5.0","versionType":"custom","status":"unknown"},{"version":"4.5.0","lessThan":"4.5.0.31","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Traffic Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.5.0","versionType":"custom","status":"unknown"},{"version":"4.5.0","lessThan":"4.5.0.31","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Carbon API Manager Rest API Utility","defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","versions":[{"version":"6.6.163","lessThan":"6.6.163.159","versionType":"custom","status":"affected"},{"version":"6.6.163","lessThan":"6.6.163.160","versionType":"custom","status":"affected"},{"version":"6.7.206","lessThan":"6.7.206.574","versionType":"custom","status":"affected"},{"version":"6.7.206","lessThan":"6.7.206.576","versionType":"custom","status":"affected"},{"version":"6.7.210","lessThan":"6.7.210.69","versionType":"custom","status":"affected"},{"version":"6.7.210","lessThan":"6.7.210.71","versionType":"custom","status":"affected"},{"version":"9.0.174","lessThan":"9.0.174.536","versionType":"custom","status":"affected"},{"version":"9.20.74","lessThan":"9.20.74.384","versionType":"custom","status":"affected"},{"version":"9.20.74","lessThan":"9.20.74.385","versionType":"custom","status":"affected"},{"version":"9.28.116","lessThan":"9.28.116.380","versionType":"custom","status":"affected"},{"version":"9.29.120","lessThan":"9.29.120.202","versionType":"custom","status":"affected"},{"version":"9.30.67","lessThan":"9.30.67.125","versionType":"custom","status":"affected"},{"version":"9.31.86","lessThan":"9.31.86.90","versionType":"custom","status":"affected"},{"version":"9.32.147","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]},{"vendor":"WSO2","product":"WSO2 Carbon API Manager Rest API Common Functions","defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common","versions":[{"version":"9.0.174","lessThan":"9.0.174.538","versionType":"custom","status":"affected"},{"version":"9.20.74","lessThan":"9.20.74.385","versionType":"custom","status":"affected"},{"version":"9.28.116","lessThan":"9.28.116.382","versionType":"custom","status":"affected"},{"version":"9.29.120","lessThan":"9.29.120.204","versionType":"custom","status":"affected"},{"version":"9.30.67","lessThan":"9.30.67.126","versionType":"custom","status":"affected"},{"version":"9.31.86","lessThan":"9.31.86.91","versionType":"custom","status":"affected"},{"version":"9.32.147","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":5.5}]},"weaknesses":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}},{"cve":{"id":"CVE-2026-120345","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T06:17:43.410","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"WAVLINK","product":"WN551X3-A","cpes":["cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*"],"modules":["DNS Resolution Handler"],"versions":[{"version":"M51X3_V251020-WO-182e965","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_dns_resolution_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120345","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/919579","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429670","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429670/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120347","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T06:17:43.600","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"dayrui","product":"XunRuiCMS","cpes":["cpe:2.3:a:xunruicms:xunruicms:*:*:*:*:*:*:*:*"],"modules":["Member Module"],"versions":[{"version":"4.7.0","status":"affected"},{"version":"4.7.1","status":"affected"},{"version":"4.7.2","status":"affected"},{"version":"4.7.3","status":"affected"},{"version":"4.7.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://gitee.com/dayrui/xunruicms/","source":"cna@vuldb.com"},{"url":"https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231","source":"cna@vuldb.com"},{"url":"https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120347","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016284","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429671","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429671/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-120348","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T06:17:43.787","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"dayrui","product":"XunRuiCMS","cpes":["cpe:2.3:a:xunruicms:xunruicms:*:*:*:*:*:*:*:*"],"modules":["Email Template Rendering"],"versions":[{"version":"4.7.0","status":"affected"},{"version":"4.7.1","status":"affected"},{"version":"4.7.2","status":"affected"},{"version":"4.7.3","status":"affected"},{"version":"4.7.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120348","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016298","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429672","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429672/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-101170","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:01.477","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DoS vulnerability in the file parsing module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-115"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101171","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:01.777","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the background task management module.\nImpact: Successful exploitation of this vulnerability may affect service integrity."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-264"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101172","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:01.973","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-264"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101173","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.137","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DoS vulnerability in the DSoftBus module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101174","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.273","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DoS vulnerability in the DSoftBus module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101175","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.420","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference vulnerability in the ArkWeb module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101176","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.577","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the event notification management module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"4.3.3","status":"affected"},{"version":"4.3.1","status":"affected"},{"version":"4.3.0","status":"affected"},{"version":"4.2.0","status":"affected"},{"version":"4.0.0","status":"affected"}]},{"vendor":"Huawei","product":"EMUI","defaultStatus":"unaffected","versions":[{"version":"16.0.0","status":"affected"},{"version":"15.0.0","status":"affected"},{"version":"14.2.0","status":"affected"},{"version":"14.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.5}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-264"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101177","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.700","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the Optimizer module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"4.3.3","status":"affected"},{"version":"4.3.1","status":"affected"},{"version":"4.3.0","status":"affected"},{"version":"4.2.0","status":"affected"},{"version":"4.0.0","status":"affected"}]},{"vendor":"Huawei","product":"EMUI","defaultStatus":"unaffected","versions":[{"version":"16.0.0","status":"affected"},{"version":"15.0.0","status":"affected"},{"version":"14.2.0","status":"affected"},{"version":"14.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-264"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101179","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.830","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow vulnerability in the file preview module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-19"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101180","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:02.970","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DoS vulnerability in the file parsing module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101181","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:03.097","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the WLAN module. \nImpact: Successful exploitation of this vulnerability may affect service confidentiality."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101182","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:03.220","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition vulnerability in the location service module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":3.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101183","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:03.360","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"UAF vulnerability in the location service module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"},{"version":"7.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":3.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101185","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:03.483","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OOB read vulnerability in the peripheral module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":3.4}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-805"}]}],"references":[{"url":"https://consumer.huawei.com/cn/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101186","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T07:18:03.617","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DoS vulnerability in the window module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-19"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-120349","sourceIdentifier":"cna@vuldb.com","published":"2026-11-02T07:18:03.843","lastModified":"2026-11-02T16:19:19.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"dayrui","product":"XunRuiCMS","cpes":["cpe:2.3:a:xunruicms:xunruicms:*:*:*:*:*:*:*:*"],"modules":["Mobile Site Directory"],"versions":[{"version":"4.7.0","status":"affected"},{"version":"4.7.1","status":"affected"},{"version":"4.7.2","status":"affected"},{"version":"4.7.3","status":"affected"},{"version":"4.7.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:07:38.253796Z","id":"CVE-2026-120349","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-120349","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1016299","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429673","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/429673/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-101178","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T08:17:34.237","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the autofill service module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"4.3.3","status":"affected"},{"version":"4.3.1","status":"affected"},{"version":"4.3.0","status":"affected"},{"version":"4.2.0","status":"affected"},{"version":"4.0.0","status":"affected"}]},{"vendor":"Huawei","product":"EMUI","defaultStatus":"unaffected","versions":[{"version":"16.0.0","status":"affected"},{"version":"15.0.0","status":"affected"},{"version":"14.2.0","status":"affected"},{"version":"14.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-101184","sourceIdentifier":"psirt@huawei.com","published":"2026-11-02T08:17:35.800","lastModified":"2026-11-02T16:15:37.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Permission control vulnerability in the Bluetooth module.\nImpact: Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"4.3.1","status":"affected"},{"version":"4.3.0","status":"affected"},{"version":"4.2.0","status":"affected"},{"version":"4.0.0","status":"affected"}]},{"vendor":"Huawei","product":"EMUI","defaultStatus":"unaffected","versions":[{"version":"15.0.0","status":"affected"},{"version":"14.2.0","status":"affected"},{"version":"14.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-264"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-18199","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-11-02T08:17:36.083","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Password Manager Pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13236","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine PAM360","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8601","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-18199.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2024-7075","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","published":"2026-11-02T10:17:10.470","lastModified":"2026-11-02T16:22:25.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.\n\nSuccessful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented."}],"affected":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","affectedData":[{"vendor":"WSO2","product":"WSO2 Enterprise Integrator","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.6.0","versionType":"custom","status":"unknown"},{"version":"6.6.0","lessThan":"6.6.0.212","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.2.0","versionType":"custom","status":"unknown"},{"version":"3.2.0","lessThan":"3.2.0.388","versionType":"custom","status":"affected"},{"version":"3.2.1","lessThan":"3.2.1.31","versionType":"custom","status":"affected"},{"version":"4.0.0","lessThan":"4.0.0.325","versionType":"custom","status":"affected"},{"version":"4.1.0","lessThan":"4.1.0.186","versionType":"custom","status":"affected"},{"version":"4.2.0","lessThan":"4.2.0.125","versionType":"custom","status":"affected"},{"version":"4.3.0","lessThan":"4.3.0.36","versionType":"custom","status":"affected"},{"version":"4.4.0","lessThan":"4.4.0.2","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.11.0","versionType":"custom","status":"unknown"},{"version":"5.11.0","lessThan":"5.11.0.364","versionType":"custom","status":"affected"},{"version":"6.0.0","lessThan":"6.0.0.208","versionType":"custom","status":"affected"},{"version":"6.1.0","lessThan":"6.1.0.187","versionType":"custom","status":"affected"},{"version":"7.0.0","lessThan":"7.0.0.60","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Carbon User Management UI","defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.user.mgt.ui","versions":[{"version":"5.14.127","lessThan":"5.14.127.12","versionType":"custom","status":"affected"},{"version":"5.17.118","lessThan":"5.17.118.12","versionType":"custom","status":"affected"},{"version":"5.18.187","lessThan":"5.18.187.266","versionType":"custom","status":"affected"},{"version":"5.18.187","lessThan":"5.18.187.282","versionType":"custom","status":"affected"},{"version":"5.18.248","lessThan":"5.18.248.24","versionType":"custom","status":"affected"},{"version":"5.23.8","lessThan":"5.23.8.185","versionType":"custom","status":"affected"},{"version":"5.24.8","lessThan":"5.24.8.13","versionType":"custom","status":"affected"},{"version":"5.25.92","lessThan":"5.25.92.93","versionType":"custom","status":"affected"},{"version":"5.25.705","lessThan":"5.25.705.13","versionType":"custom","status":"affected"},{"version":"5.25.713","lessThan":"5.25.713.3","versionType":"custom","status":"affected"},{"version":"7.0.78","lessThan":"7.0.78.34","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}]},"weaknesses":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3569/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}},{"cve":{"id":"CVE-2025-13647","sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","published":"2026-11-02T10:17:10.707","lastModified":"2026-11-02T16:22:25.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system."}],"affected":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","affectedData":[{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.10.0","versionType":"custom","status":"unknown"},{"version":"5.10.0","lessThan":"5.10.0.381","versionType":"custom","status":"affected"},{"version":"5.11.0","lessThan":"5.11.0.428","versionType":"custom","status":"affected"},{"version":"6.0.0","lessThan":"6.0.0.255","versionType":"custom","status":"affected"},{"version":"6.1.0","lessThan":"6.1.0.255","versionType":"custom","status":"affected"},{"version":"7.0.0","lessThan":"7.0.0.133","versionType":"custom","status":"affected"},{"version":"7.1.0","lessThan":"7.1.0.41","versionType":"custom","status":"affected"},{"version":"7.2.0","lessThan":"7.2.0.3","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.0","versionType":"custom","status":"unknown"},{"version":"2.0.0","lessThan":"2.0.0.421","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.10.0","versionType":"custom","status":"unknown"},{"version":"5.10.0","lessThan":"5.10.0.372","versionType":"custom","status":"affected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server Keystore Rest API Commons","defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.api.server.keystore.management.common","versions":[{"version":"1.0.82","lessThan":"1.0.82.25","versionType":"custom","status":"affected"},{"version":"1.0.190","lessThan":"1.0.190.17","versionType":"custom","status":"affected"},{"version":"1.2.3","lessThan":"1.2.3.6","versionType":"custom","status":"affected"},{"version":"1.2.23","lessThan":"1.2.23.10","versionType":"custom","status":"affected"},{"version":"1.2.176","lessThan":"1.2.176.18","versionType":"custom","status":"affected"},{"version":"1.3.83","lessThan":"1.3.83.10","versionType":"custom","status":"affected"},{"version":"1.3.213","lessThan":"1.3.213.1","versionType":"custom","status":"affected"},{"version":"1.3.221","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]},{"vendor":"WSO2","product":"WSO2 Identity Server Keystore Rest API V1","defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1","versions":[{"version":"1.0.82","lessThan":"1.0.82.25","versionType":"custom","status":"affected"},{"version":"1.0.190","lessThan":"1.0.190.17","versionType":"custom","status":"affected"},{"version":"1.2.3","lessThan":"1.2.3.6","versionType":"custom","status":"affected"},{"version":"1.2.23","lessThan":"1.2.23.10","versionType":"custom","status":"affected"},{"version":"1.2.176","lessThan":"1.2.176.18","versionType":"custom","status":"affected"},{"version":"1.3.83","lessThan":"1.3.83.10","versionType":"custom","status":"affected"},{"version":"1.3.213","lessThan":"1.3.213.1","versionType":"custom","status":"affected"},{"version":"1.3.221","lessThanOrEqual":"*","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}]}},{"cve":{"id":"CVE-2026-118871","sourceIdentifier":"psirt@zte.com.cn","published":"2026-11-02T10:17:11.123","lastModified":"2026-11-02T16:22:25.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in."}],"affected":[{"source":"psirt@zte.com.cn","affectedData":[{"vendor":"ZTE","product":"ElasticNet RNIA R18 NGI","defaultStatus":"unaffected","versions":[{"version":"NGIV16.26.11SP04 and earlier versions","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@zte.com.cn","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@zte.com.cn","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240","source":"psirt@zte.com.cn"}]}},{"cve":{"id":"CVE-2026-8923","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-11-02T11:17:33.380","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Eventlog Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13062","versionType":"13062","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Log360","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13062","versionType":"13062","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-111560","sourceIdentifier":"mandiant-cve@google.com","published":"2026-11-02T13:17:35.190","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed."}],"affected":[{"source":"mandiant-cve@google.com","affectedData":[{"vendor":"Barracuda Networks","product":"Barracuda Email Security Gateway (ESG)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.4.0.27","versionType":"custom","status":"affected"}]},{"vendor":"Barracuda Networks","product":"Barracuda Load Balancer Application Delivery Controller (ADC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.4.0","versionType":"custom","status":"affected"}]},{"vendor":"Barracuda Networks","product":"Barracuda Web Application Firewall (WAF)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"11.0.1","versionType":"custom","status":"affected"}]},{"vendor":"Barracuda Networks","product":"Barracuda Web Security Gateway (WSG)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"16.1.100.100","versionType":"custom","status":"affected"}]},{"vendor":"Barracuda Networks","product":"Barracuda Message Archiver (BMA)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.5.4.0","versionType":"custom","status":"affected"}]},{"vendor":"Barracuda Networks","product":"Barracuda WAF Control Center (WCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.2.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"mandiant-cve@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"mandiant-cve@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","source":"mandiant-cve@google.com"},{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","source":"mandiant-cve@google.com"}]}},{"cve":{"id":"CVE-2026-116606","sourceIdentifier":"mandiant-cve@google.com","published":"2026-11-02T13:17:37.017","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration."}],"affected":[{"source":"mandiant-cve@google.com","affectedData":[{"vendor":"Barracuda Networks","product":"Barracuda Email Security Gateway (ESG)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"9.4.0.030","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"mandiant-cve@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"mandiant-cve@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","source":"mandiant-cve@google.com"},{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","source":"mandiant-cve@google.com"}]}},{"cve":{"id":"CVE-2026-91903","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:39.703","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.2}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91904","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:39.870","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91905","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.020","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.9}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91906","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.183","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:06:26.316209Z","id":"CVE-2026-91906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91907","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.347","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering"}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91908","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.497","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.2}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91909","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.650","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91910","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.797","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":3.6}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-91911","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:40.943","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T14:06:55.388013Z","id":"CVE-2026-91911","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-94349","sourceIdentifier":"security_alert@emc.com","published":"2026-11-02T13:17:41.583","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.8.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-109083","sourceIdentifier":"security@apache.org","published":"2026-11-02T14:17:35.127","lastModified":"2026-11-02T16:12:04.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\nAn administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn","packageURL":"pkg:maven/org.apache.syncope.ext.flowable/syncope-ext-flowable-bpmn","versions":[{"version":"3.0.0-M0","lessThanOrEqual":"3.0.16","versionType":"semver","status":"affected"},{"version":"4.0.0-M0","lessThanOrEqual":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-653"}]}],"references":[{"url":"https://lists.apache.org/thread.html/zmzxzxv7wjzn071jgn069y2rqjpcrt3s","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-110535","sourceIdentifier":"security@apache.org","published":"2026-11-02T14:17:35.270","lastModified":"2026-11-02T16:12:04.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Privilege Management vulnerability in Apache Syncope.\n\n\n\nAuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.\nThis issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.syncope.core.am:syncope-core-am-logic","packageURL":"pkg:maven/org.apache.syncope.core.am/syncope-core-am-logic","versions":[{"version":"3.0.12","lessThanOrEqual":"3.0.16","versionType":"semver","status":"affected"},{"version":"4.0.0-M0","lessThanOrEqual":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0-M0","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-113511","sourceIdentifier":"security@apache.org","published":"2026-11-02T14:17:35.650","lastModified":"2026-11-02T16:12:04.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization bypass through User-Controlled key vulnerability in Apache Syncope.\n\n\n\nA delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.syncope.core.idrepo:syncope-core-idrepo-logic","packageURL":"pkg:maven/org.apache.syncope.core.idrepo/syncope-core-idrepo-logic","versions":[{"version":"3.0.0-M0","lessThanOrEqual":"3.0.16","versionType":"semver","status":"affected"},{"version":"4.0.0-M0","lessThanOrEqual":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0-M0","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-113687","sourceIdentifier":"security@apache.org","published":"2026-11-02T14:17:35.790","lastModified":"2026-11-02T16:12:04.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\n\n\nAn administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.syncope.core:syncope-core-spring","packageURL":"pkg:maven/org.apache.syncope.core/syncope-core-spring","versions":[{"version":"3.0.0-M0","lessThanOrEqual":"3.0.16","versionType":"semver","status":"affected"},{"version":"4.0.0-M0","lessThanOrEqual":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0-M0","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-653"}]}],"references":[{"url":"https://lists.apache.org/thread.html/xxfmworgxt6bf1got05b5pqbb679zjp0","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-114364","sourceIdentifier":"security@apache.org","published":"2026-11-02T14:17:35.930","lastModified":"2026-11-02T16:12:04.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.\n\n\n\nThis CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters.\nReference: https://cve.org/CVERecord?id=CVE-2026-77051\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.syncope.core:syncope-core-persistence-jpa","packageURL":"pkg:maven/org.apache.syncope.core/syncope-core-persistence-jpa","versions":[{"version":"3.0.0-M0","lessThanOrEqual":"3.0.16","versionType":"semver","status":"affected"},{"version":"4.0.0-M0","lessThanOrEqual":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0-M0","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://lists.apache.org/thread.html/j65oo441q5gpr4d0ljb644r9mdro2slm","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2025-62819","sourceIdentifier":"cve@mitre.org","published":"2026-11-02T15:17:11.403","lastModified":"2026-11-02T16:18:52.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://support.keyfactor.com/hc/en-us/articles/57971026069531-Security-advisory-EJBCA-unauthorized-client-certificate-renewal-in-RA-Web","source":"cve@mitre.org"},{"url":"https://trust.keyfactor.com","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-120425","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:23.407","lastModified":"2026-11-02T16:17:32.070","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"munafio","product":"Chatify","defaultStatus":"unaffected","repo":"https://github.com/munafio/chatify","packageURL":"pkg:composer/munafio/chatify","versions":[{"version":"0","lessThan":"1.6.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:52:04.247974Z","id":"CVE-2026-120425","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124","source":"disclosure@vulncheck.com"},{"url":"https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a","source":"disclosure@vulncheck.com"},{"url":"https://github.com/munafio/chatify/issues/412","source":"disclosure@vulncheck.com"},{"url":"https://github.com/munafio/chatify/releases/tag/v1.6.4","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieund/cve-2026-120425-chatify-pusher-channel-authorization-bypass","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-120429","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:24.190","lastModified":"2026-11-02T16:17:32.223","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"owen2345","product":"Camaleon CMS","defaultStatus":"unaffected","repo":"https://github.com/owen2345/camaleon-cms","packageURL":"pkg:gem/camaleon_cms","versions":[{"version":"0","lessThan":"2.9.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:51:07.817487Z","id":"CVE-2026-120429","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/media_controller.rb","source":"disclosure@vulncheck.com"},{"url":"https://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf99256dfe32b5f674baf4f771606549e","source":"disclosure@vulncheck.com"},{"url":"https://github.com/owen2345/camaleon-cms/pull/1147","source":"disclosure@vulncheck.com"},{"url":"https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120433","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:24.940","lastModified":"2026-11-02T16:17:32.360","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Netpbm","product":"Netpbm","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.86.51","versionType":"custom","status":"affected"},{"version":"11.0","lessThan":"11.02.30","versionType":"custom","status":"affected"},{"version":"11.03","lessThan":"11.15.08","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:05:35.509455Z","id":"CVE-2026-120433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5328/","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5327/trunk/converter/ppm/picttoppm.c","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120437","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:25.603","lastModified":"2026-11-02T16:17:32.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Netpbm","product":"Netpbm","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.86.51","versionType":"custom","status":"affected"},{"version":"11.0","lessThan":"11.02.30","versionType":"custom","status":"affected"},{"version":"11.03","lessThan":"11.15.08","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:00:06.426973Z","id":"CVE-2026-120437","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5334/","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5333/trunk/converter/ppm/tgatoppm.c","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","source":"disclosure@vulncheck.com"},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-out-of-bounds-read-via-tgatoppm","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120441","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:26.307","lastModified":"2026-11-02T16:17:32.690","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OwnTone","product":"OwnTone Server","defaultStatus":"unaffected","repo":"https://github.com/owntone/owntone-server","packageURL":"pkg:github/owntone/owntone-server","versions":[{"version":"0","lessThanOrEqual":"29.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:55:06.482825Z","id":"CVE-2026-120441","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029","source":"disclosure@vulncheck.com"},{"url":"https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-command","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120445","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:27.107","lastModified":"2026-11-02T16:17:32.960","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"madong-code","product":"madong-admin-saas","defaultStatus":"unaffected","repo":"https://github.com/madong-code/madong-admin-saas","versions":[{"version":"0","lessThanOrEqual":"5.1.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:54:25.850369Z","id":"CVE-2026-120445","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/middleware/AccessTokenMiddleware.php#L62-L73","source":"disclosure@vulncheck.com"},{"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","source":"disclosure@vulncheck.com"},{"url":"https://github.com/madong-code/madong-admin-saas/issues/2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120449","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:27.937","lastModified":"2026-11-02T16:17:33.140","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Outline","product":"Outline","defaultStatus":"unaffected","repo":"https://github.com/outline/outline","packageURL":"pkg:github/outline/outline","versions":[{"version":"0","lessThan":"1.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:42:37.475888Z","id":"CVE-2026-120449","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-672"}]}],"references":[{"url":"https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77","source":"disclosure@vulncheck.com"},{"url":"https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52","source":"disclosure@vulncheck.com"},{"url":"https://github.com/outline/outline/releases/tag/v1.12.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares","source":"disclosure@vulncheck.com"},{"url":"https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-120453","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:28.750","lastModified":"2026-11-02T16:17:33.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"The Sleuth Kit","product":"The Sleuth Kit","defaultStatus":"unaffected","repo":"https://github.com/sleuthkit/sleuthkit","packageURL":"pkg:github/sleuthkit/sleuthkit","versions":[{"version":"0","lessThanOrEqual":"4.15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:44:16.255285Z","id":"CVE-2026-120453","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/hfs.c#L4249-L4318","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sleuthkit/sleuthkit/issues/3583","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-heap-out-of-bounds-read-via-hfs-decmpfs-header","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-120457","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:29.507","lastModified":"2026-11-02T16:17:33.493","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Deutsches Klimarechenzentrum","product":"libaec","defaultStatus":"unaffected","repo":"https://github.com/Deutsches-Klimarechenzentrum/libaec","versions":[{"version":"0","lessThanOrEqual":"1.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:45:31.200283Z","id":"CVE-2026-120457","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-196"}]}],"references":[{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-120461","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:30.247","lastModified":"2026-11-02T16:17:33.673","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"dromara","product":"Jpom","defaultStatus":"unaffected","repo":"https://github.com/dromara/Jpom","versions":[{"version":"0","lessThanOrEqual":"2.11.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:47:16.110618Z","id":"CVE-2026-120461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184","source":"disclosure@vulncheck.com"},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169","source":"disclosure@vulncheck.com"},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","source":"disclosure@vulncheck.com"},{"url":"https://github.com/dromara/Jpom/issues/120","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120491","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:31.040","lastModified":"2026-11-02T16:17:33.843","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Wing FTP Software","product":"Wing FTP Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:48:21.503109Z","id":"CVE-2026-120491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.vulncheck.com/advisories/wing-ftp-server-before-8.2.6-stored-xss-via-nowpath-in-legacy-activity-page","source":"disclosure@vulncheck.com"},{"url":"https://www.wftpserver.com/serverhistory.htm","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-73695","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:37.287","lastModified":"2026-11-02T16:17:42.703","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-73696","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:37.480","lastModified":"2026-11-02T16:17:42.863","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-698"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-execution-after-redirect-in-cwpuserindex","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-73697","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T15:17:37.660","lastModified":"2026-11-02T16:17:43.037","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:49:11.876524Z","id":"CVE-2026-73697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection-via-phpini-editor","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-104080","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:22.740","lastModified":"2026-11-02T16:17:22.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-valid-token","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120500","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:34.007","lastModified":"2026-11-02T16:17:34.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"redimp","product":"otterwiki","defaultStatus":"unaffected","repo":"https://github.com/redimp/otterwiki","packageURL":"pkg:pypi/otterwiki","versions":[{"version":"2.0.0","lessThan":"2.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T16:05:05.332198Z","id":"CVE-2026-120500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/redimp/otterwiki/commit/b2e91d20ed36c01ce140d18698f9abb90685d481","source":"disclosure@vulncheck.com"},{"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/an-otter-wiki-before-2.26.2-stored-xss-via-math-code-block","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-120501","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:34.227","lastModified":"2026-11-02T16:17:34.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"redimp","product":"otterwiki","defaultStatus":"unaffected","repo":"https://github.com/redimp/otterwiki","packageURL":"pkg:pypi/otterwiki","versions":[{"version":"2.20.1","lessThan":"2.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://github.com/redimp/otterwiki/commit/263cac4981f60d92c46adf6386591cf4bc4d6835","source":"disclosure@vulncheck.com"},{"url":"https://github.com/redimp/otterwiki/releases/tag/v2.26.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/an-otter-wiki-2.20.1-before-2.26.2-repository-file-disclosure-via-datatable-src","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-16306","sourceIdentifier":"cret@cert.org","published":"2026-11-02T16:17:34.420","lastModified":"2026-11-02T16:17:34.420","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"INFINITT Healthcare","product":"System Manager","versions":[{"version":"3.0.11.3","lessThanOrEqual":"3.0.11.5","versionType":"custom","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://www.infinittna.com/","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-77876","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.293","lastModified":"2026-11-02T16:17:43.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77877","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.473","lastModified":"2026-11-02T16:17:43.473","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77878","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.640","lastModified":"2026-11-02T16:17:43.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-02T15:49:43.834589Z","id":"CVE-2026-77878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77879","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.810","lastModified":"2026-11-02T16:17:43.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":5.2}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-sql-injection-via-access-token-api","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77880","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:43.973","lastModified":"2026-11-02T16:17:43.973","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.16","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-77881","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-02T16:17:44.137","lastModified":"2026-11-02T16:17:44.137","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Control Web Panel","product":"Control Web Panel","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://control-webpanel.com/changelog","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-88809","sourceIdentifier":"meissner@suse.de","published":"2026-11-02T16:17:44.897","lastModified":"2026-11-02T16:17:44.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"SUSE","product":"Rancher","defaultStatus":"unaffected","packageName":"Rancher","repo":"https://github.com/rancher/rancher/","versions":[{"version":"2.15.0","lessThan":"2.15.3","versionType":"semver","status":"affected"},{"version":"2.14.0","lessThan":"2.14.7","versionType":"semver","status":"affected"},{"version":"2.13.0","lessThan":"2.13.11","versionType":"semver","status":"affected"},{"version":"2.12.0","lessThan":"2.12.15","versionType":"semver","status":"affected"},{"version":"2.11.0","lessThan":"2.11.19","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}]},"weaknesses":[{"source":"meissner@suse.de","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-99217","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:45.570","lastModified":"2026-11-02T16:17:45.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfork: release the files of a failed fork after sched_cancel_fork()\n\nReorder copy_process() cleanup so sched_fork() taking scx_fork_rwsem\nscx_pre_fork() is safe and isn't held around exiting files. Right now, a\nfork that fails while another thread closed the bpf link fd will\ndeadlock against its own read side. It also blocks every fork on the\nsystem:\n\n    copy_process()                  holds scx_fork_rwsem for read\n      exit_files()\n        close_files()\n          filp_close_sync()\n            bpf_scx_unreg()\n              kthread_flush_work()  waits for the disable work\n                scx_root_disable()\n                  percpu_down_write(&scx_fork_rwsem)\n\nSimply release the child's files after sched_cancel_fork() dropped the\nlock. The task starts out as a copy of its parent so p->files points to\nthe parent's table until copy_files() replaces it. exit_files() must not\nrun for a fork that failed before that. Clear p->files up front so\nexit_files() is a no-op for those and make copy_files() set it\nexplicitly for CLONE_FILES."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"27e1cbf8ec5f7117f6bb2d2e44030ac055f09097","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f7ac8500d58e7684d37403553b1dea90ee2b27b1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"14c7de6ca239326b79fd3f7aee55dfada1bb72ab","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"afa8eb069694bd9f845e5e44eac6e81cbc06780e","versionType":"git","status":"affected"},{"version":"0","lessThan":"6.12.115","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.60","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.2.14","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.3.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14c7de6ca239326b79fd3f7aee55dfada1bb72ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/27e1cbf8ec5f7117f6bb2d2e44030ac055f09097","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/afa8eb069694bd9f845e5e44eac6e81cbc06780e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7ac8500d58e7684d37403553b1dea90ee2b27b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99218","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:45.740","lastModified":"2026-11-02T16:17:45.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"fd0fbe84312fda2fc187428c92c50b7d03a9d24c","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"71146c437bae59e5280f657965dc6d006ee3989b","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"0fce73efee40c65ce26641c5d93942462f9e8307","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"16e94ed90b1b02398e044d41fd1db34828daa08e","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","versionType":"git","status":"affected"},{"version":"a94e2d408eaedbd85aae259621d46fafc10479a2","lessThan":"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","lessThan":"2.6.27","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99219","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:45.940","lastModified":"2026-11-02T16:17:45.940","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"753d5cba113a52cb155428f4ea93a4b0148c4bf1","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"0e5ff07be834abaf4280e1dca7f9591e339d0960","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"e2e6fb972bfec4a0551bc7c185bdb17f78f94997","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"8932e5a4df110a25578728526bb5a3dbc849d8a2","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"7271c064dd60d4456c5b90da757acd9420d06697","versionType":"git","status":"affected"},{"version":"b39181f7c6907dc66ff937b74758671fa6ba430c","lessThan":"d97dba9ff13987d1fc415408557a54adde980311","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/ftrace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0e5ff07be834abaf4280e1dca7f9591e339d0960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7271c064dd60d4456c5b90da757acd9420d06697","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/753d5cba113a52cb155428f4ea93a4b0148c4bf1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8932e5a4df110a25578728526bb5a3dbc849d8a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d97dba9ff13987d1fc415408557a54adde980311","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2e6fb972bfec4a0551bc7c185bdb17f78f94997","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99220","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.113","lastModified":"2026-11-02T16:17:46.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n  <TASK>\n  __key_create_or_update (security/keys/key.c:884)\n  key_create_or_update (security/keys/key.c:1021)\n  __do_sys_add_key (security/keys/keyctl.c:134)\n  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"889a2293a95f6c2880bf73b67f9b0af23251a128","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"7f0728ba89624e25df2bb80ff59bbfb545060935","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"2a40bdd4409567de4c2a141ac66439dc238af752","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"33a078f04e264eb71aa9f209cb334e4010123818","versionType":"git","status":"affected"},{"version":"3c58b2362ba828ee2970c66c6a6fd7b04fde4413","lessThan":"57e54b6939c6539d90a81c7e57531901d5991651","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["crypto/asymmetric_keys/restrict.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99221","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.293","lastModified":"2026-11-02T16:17:46.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"4876f09ce222e140a73aad950882b3605440c935","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"2d92a0f87c338a08367aff05edd1ade86da4ac8d","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"234d09bb3b3d84851d4b3246272addc30f3353eb","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"6e359d8cb8580b9874801dea930086effd4d9c62","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"63b19ec2863b2cb5279b746ecd3d6210b1a93945","versionType":"git","status":"affected"},{"version":"5d0682be318910e028bdf57c90a1695ffc34be37","lessThan":"ed697a5f667435bbb1cedbe5bd9f300de645047d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/trusted-keys/trusted_tpm1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99222","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.460","lastModified":"2026-11-02T16:17:46.460","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n  KEYCTL_READ task                    Module unload and key GC\n  ----------------                   ------------------------\n  lookup_user_key()\n  permission / possession checks\n  load key->type\n                                     af_rxrpc_exit()\n                                       unregister_key_type()\n                                         GC: down_write(key->sem)\n                                         GC: retype to key_type_dead\n                                         GC: up_write(key->sem)\n                                       unregister_key_type() returns\n                                     free_module()\n  read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"e5f830ae6611cddbfc504c43f14155f60b63206a","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"1486caee47b4909f52835a957c3293e970113e44","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"ff44f1b303aa76a818d898e85c56ed4852c031e2","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"3edc064069d07e7d37359fcb4d03d3bab15ee3ab","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","versionType":"git","status":"affected"},{"version":"d3ec10aa95819bff18a0d936b18884c7816d0914","lessThan":"e2a2deda08d91644f5e30c17d267b1cdc5f124b2","versionType":"git","status":"affected"},{"version":"7fa67aa30509ad0da72ac0f757aa76e53c0ea3de","versionType":"git","status":"affected"},{"version":"18779eac17b5df9dff57138d07631573553a41d4","versionType":"git","status":"affected"},{"version":"f1afcf9488fc45765e20e2047d3b776981900e0b","versionType":"git","status":"affected"},{"version":"212d3adb1af4e34acb158d6c6def370016a1011d","versionType":"git","status":"affected"},{"version":"4.14.177","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.118","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.35","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.6.7","lessThan":"5.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99223","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.650","lastModified":"2026-11-02T16:17:46.650","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring indexes independent of kernel addresses\n\nKEYCTL_READ returns the serial numbers in a keyring in associative-array\ntraversal order.  The first word of the index is a public, deterministic\nhash of the type pointer, domain pointer and description.  An unprivileged\nuser can therefore insert keys with known descriptions, predict their\norder for each possible KASLR slide, and recover the kernel image address.\nOn an x86-64 build with 16 MiB alignment, 45 user keys suffice to\ndistinguish the candidate slides.\n\nRemove the addresses from the whole index, not just its first hash word.\nAssign each key type and domain a nonzero 64-bit ID and hash those IDs and\nthe description with a once-initialized SipHash key.  Use the full IDs in\nthe later index chunks as well.  Truncating or hashing the IDs there would\nlose the guarantee that distinct type/domain/description tuples have a\ndiffering index bit.\n\nAllocate IDs lazily since private key types need not be registered.  Cache\nthem in the index key so tree walks and copies of an existing index do not\nneed to dereference a type descriptor that may have been unregistered.\nKeep the 32-bit chunk layout and diff_objects() bit offsets consistent,\nand retain the separate root slot for keyrings used by recursive search.\nThe key comparison, permissions and userspace data format are unchanged;\nonly the address-dependent in-memory ordering is replaced."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"9ebe824d55983c9f063a2c9ef1a08b29812d406f","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"e108b22999edbc6f431466baf6b2016c19b7ed31","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"9f084ef0beb68091e96ab96f0e95579aac8a77f9","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"13fc051269d670810d9e314061b61c6dd06116a0","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"61ac0585d9f4344d3dfb84b5edff1fee7d532897","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"84f7c699f8d139f743c7dc11ef41d085690955bb","versionType":"git","status":"affected"},{"version":"b2a4df200d570b2c33a57e1ebfa5896e4bc81b69","lessThan":"a113eba06bd1183c614d7994864d6e7054140cb9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/key-type.h","include/linux/key.h","security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99224","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:46.830","lastModified":"2026-11-02T16:17:46.830","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"19c4de819e52b7f606468fbfe4fcef4e812e2777","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"916667df7695366f23cfaf365b5840b228cc4b2e","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"dddd3a1ab7d12ee163477918ff6eb943361db4fe","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"3c3cfd9e262afc9558c38f8cec57f09d10988546","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"6b613747f7ea309ada5b8d05b55398c338f7a968","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"dea367df18e3a4faac393e3a4e818ee03af89b19","versionType":"git","status":"affected"},{"version":"aa9d4437893f7e015ce5b6d6c443a9ba92c8a2e7","lessThan":"0461bc8f91116aae4a020e15f4e1c1fd535ab35e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.18","status":"affected"},{"version":"0","lessThan":"3.18","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99225","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.047","lastModified":"2026-11-02T16:17:47.047","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Check the authorization payload in process keyring searches\n\nAn authorization payload and its saved credentials must remain valid\nwhile search_process_keyrings_rcu() searches the requestor's keyrings.\nThe function validates the authorization key, then separately loads\npayload.data[0] and unconditionally reads rka->cred. Validation does\nnot prevent request_key_auth_revoke() from clearing the payload.\n\nA request-key helper can assume authority and fork a descendant that\ninherits the authorization key. If the descendant misses in its own\nkeyrings, it falls back to the saved requestor credentials. Successful\ntarget instantiation invalidates the authorization key without clearing\nthe payload. After the helper exits, UMH_WAIT_PROC returns to the\nrequester, which calls complete_request_key() and revokes that key.\n\nWith the descendant paused after validation, the paths can interleave\nas follows:\n\n  1. The descendant enters search_process_keyrings_rcu() under RCU and\n     key_validate() succeeds.\n  2. The helper instantiates the target, invalidates the authorization\n     key, and exits.\n  3. The requester resumes from UMH_WAIT_PROC, calls\n     complete_request_key(), and revokes the authorization key.\n     request_key_auth_revoke() sets its payload pointer to NULL.\n  4. The descendant loads NULL and dereferences rka->cred.\n\nThis NULL dereference can oops the kernel. RCU delays payload disposal\nbut does not prevent the pointer from being cleared.\n\nLoad the payload with dereference_key_rcu() and require a non-NULL\nresult before validating the authorization key and searching its saved\ncredentials. A non-NULL payload and its credentials remain alive for\nthe caller's RCU read-side section; a cleared payload skips the fallback\nsearch and follows the existing error selection.\n\nKASAN report as below:\n\n    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI\n    KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n    RIP: 0010:search_process_keyrings_rcu+0x32b/0x790"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/process_keys.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"14fb6fad526b35a7ebd121f1dd313abe652e0aa6","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"7d3d2fffe933e538472ccafe5bbc7109488b9ce3","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"26949c2e4c461e9e620e935bc22717f36a40b615","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"984a178d54515779a1bee100b92a6cee8777c830","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"b86db7993051d05810601654e886a1e78e1fa495","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"b4dfda438fee3c6faa15d9b421c373de6a0e476f","versionType":"git","status":"affected"},{"version":"e59428f721ee096d8a020504ea908a6f0d952735","lessThan":"49f4e768540d25d8852ef750313afda6a4774871","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/process_keys.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99226","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.233","lastModified":"2026-11-02T16:17:47.233","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Avoid the owner account dereference in named keyring lookup\n\nNamed keyring lookup must keep the storage containing the owner UID\nalive through the namespace mapping check.  find_keyring_by_name()\nreads keyring->user->uid under keyring_name_lock, but that lock protects\nthe keyring's name entry and allocation, not its separate key_user.\n\nA named session-keyring join can overlap a privileged KEYCTL_CHOWN on\nanother CPU.  If the keyring holds the last reference to its old dynamic\nkey_user and the ownership transfer succeeds, the following ordering is\npossible:\n\n    Named join                         Chown\n    find_keyring_by_name()              keyctl_chown_key()\n      read_lock(keyring_name_lock)       down_write(key->sem)\n      load old keyring->user\n                                         replace key->user and key->uid\n                                         up_write(key->sem)\n                                         key_put(key)\n                                         key_user_put(old user): free\n      read old user->uid\n      read_unlock(keyring_name_lock)\n\nChown neither takes keyring_name_lock nor key_session_mutex, so it can\nfree the old account between the pointer load and the UID read.  The\nlookup then reads freed memory even though the keyring itself is alive.\n\nUse keyring->uid for the mapping check.  key_alloc() initializes this\ninline owner UID and keyctl_chown_key() updates it on chown.\nThe existing name lock keeps its containing keyring allocated throughout\nthe check, so lookup no longer depends on the account's lifetime.  This\nalso matches the owner UID used by the permission check.\n\nKASAN report as below:\n\n    BUG: KASAN: slab-use-after-free in find_keyring_by_name+0x577/0x5d0\n    Read of size 4 at addr ffff8881128ae2ec by task keycase/500"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"77249d4b1bb5ad43552b7023c4a0978937aa7a56","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"0b865fa477d94ac96c26848aab1fd176397de3f6","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"6763329f673d261641c79212abf773af77b2c922","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"aa03c8fb4334f14d218020f7431debf2b7766865","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"c9664f780f861dd9f11f120c7a03ed0993671ebb","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"b0830a26e2c3008a6e21863126b4a0e68b2761cd","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"5c6a9512887a6cc694d594d9c0b57c0841d215b5","versionType":"git","status":"affected"},{"version":"2ea190d0a006ce5218baa6e798512652446a605a","lessThan":"40b12b93ae4ab9e22c3d571e9b09fd08afad53f6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b865fa477d94ac96c26848aab1fd176397de3f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40b12b93ae4ab9e22c3d571e9b09fd08afad53f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c6a9512887a6cc694d594d9c0b57c0841d215b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6763329f673d261641c79212abf773af77b2c922","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77249d4b1bb5ad43552b7023c4a0978937aa7a56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa03c8fb4334f14d218020f7431debf2b7766865","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0830a26e2c3008a6e21863126b4a0e68b2761cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9664f780f861dd9f11f120c7a03ed0993671ebb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99227","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.420","lastModified":"2026-11-02T16:17:47.420","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of ->refs and uses\nbits 30:0 as a 31-bit reference counter:\n\n  #define IO_WAITID_CANCEL_FLAG BIT(31)\n  #define IO_WAITID_REF_MASK    GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of ->refs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"20b67288574c7c3df6b8ea7ed3b7af90a868006f","versionType":"git","status":"affected"},{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"5bfeee1774791602a0d53eb717f00f172127a017","versionType":"git","status":"affected"},{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","versionType":"git","status":"affected"},{"version":"f31ecf671ddc498f20219453395794ff2383e06b","lessThan":"22fb4a4518e305164c7f203608287564de292f34","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99228","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.600","lastModified":"2026-11-02T16:17:47.600","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n  io_wq_exit_workers()               io_worker_handle_work()\n    io_wq_worker_wake()\n      set TIF_NOTIFY_SIGNAL\n                                       io_assign_current_work()\n                                         io_run_task_work()\n                                           clear TIF_NOTIFY_SIGNAL\n                                       io_wq_submit_work()\n                                         fifo_open()\n                                           wait_for_partner()\n    wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n  IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n  exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/io-wq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"ddccc60f036b309430cf130d48aafed94ef7355a","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"08c42055b8f9a5d29236d34ad4bce08828239fe1","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"62996803c1b5f18176de255db4c843021f2d19c8","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"7309fea05a3d66af9746843c43fef14c10b8141e","versionType":"git","status":"affected"},{"version":"afcc4015d1bf5659b8c722aff679e9b8c41ee156","lessThan":"fdb771015c1e13677b57a4015f0c938748f13781","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/io-wq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99229","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.780","lastModified":"2026-11-02T16:17:47.780","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/wait: don't spin on a stuck overflow list\n\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\n\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\n  is stuck on the list if a single one is free, and then the ring holds\n  less than cq_entries events. A single threaded application that asks\n  for as many events as the ring has entries never gets out of\n  io_uring_enter().\n\n- Whether the ring is full is up to the CQ head, which the application\n  can write to. While one thread waits for events on an empty ring,\n  another one can move the head back so that the ring looks full and\n  have a CQE overflow. The waiter can't be stopped any more, not even by\n  SIGKILL.\n\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/wait.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"bf1d2ed84b3162e3b0e0bb7018ac59147da6e975","versionType":"git","status":"affected"},{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"a6cfc85c6bf9498aaf1978b503f9663635a1aa22","versionType":"git","status":"affected"},{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"4a89352edd8b3e20d1e1fb33f0fc297dd137149f","versionType":"git","status":"affected"},{"version":"3fcf19d592d5cb63eb209400b22055651e3c27d0","lessThan":"c347691e5dc5481b2d6943c123619e04847fb0dc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/wait.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99230","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:47.927","lastModified":"2026-11-02T16:17:47.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n  RIP: 0010:io_futexv_complete+0x219/0x420\n  Call Trace:\n   tctx_task_work_run+0x804/0x950\n   tctx_task_work+0x71/0xa0\n   task_work_run+0x118/0x200\n\nLeave the node unhashed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/uring_cmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"93b8cc60c37b9d17732b7a297e5dca29b50a990d","lessThan":"cc7f13d006fcefed9564bd79f135b51d344e9c77","versionType":"git","status":"affected"},{"version":"93b8cc60c37b9d17732b7a297e5dca29b50a990d","lessThan":"2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707","versionType":"git","status":"affected"},{"version":"93b8cc60c37b9d17732b7a297e5dca29b50a990d","lessThan":"685b49483200384d7f49d338af476e26e6824637","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/uring_cmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99231","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.060","lastModified":"2026-11-02T16:17:48.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: own the request before clearing ->head\n\nio_waitid_remove_wq() only takes the wait queue lock if ->head is set.\nio_waitid_wait() clears ->head first thing, before it tries to become the\nowner of the request by bumping ->refs. If somebody else owns the request\nat that point, nothing keeps it from completing the request while the\nwake up handler is still going to touch it:\n\nCPU0 (io_waitid_wait)                 CPU1 (io_waitid, holds a ref)\nlist_del_init(&wait->entry)\nsmp_store_release(&iw->head, NULL)\n                                      __do_wait() finds another child\n                                      io_waitid_remove_wq()\n                                        // ->head == NULL, no locking\n                                      io_waitid_finish(), IOU_COMPLETE\n                                      // request freed and reused\natomic_fetch_inc(&iw->refs)\n\nThe same goes for __io_waitid_cancel() if it claims the request in that\nwindow. ->refs is part of the per opcode data of the request, so this\nincrements whatever the next user of the request keeps there. If that\nhappens to be zero, the handler concludes that it owns the request, and\nqueues io_waitid_cb() for it. With the window held open by a delay, and\nthe request reused for a receive that is waiting for data:\n\n  BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0\n   __wake_up_sync_key+0x36/0x50\n   sock_def_readable+0xf1/0x420\n   unix_stream_sendmsg+0x60b/0x1110\n  Allocated by task 87:\n   io_arm_apoll+0x1ed/0x940\n  Freed by task 87:\n   __io_submit_flush_completions+0x118d/0x1a10\n   tctx_task_work_run+0x327/0x950\n\nOnly clear ->head once the handler owns the request. If it doesn't, the\nowner finds ->head set and has to wait for the lock, which is held by the\ncaller of the handler. Deleting the already deleted entry again is\nharmless."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"09951a4d37e33b0197afc7fb77e39f09a3213ee6","lessThan":"bf01da1a9cca4a54e5c30b8344e52c26afb87be7","versionType":"git","status":"affected"},{"version":"934ffdd1cdef232eb125e63c2ebafb7f2deff6af","lessThan":"8381a912c65b8de16e8a848225c7c5a56b6ea834","versionType":"git","status":"affected"},{"version":"ab673c1bcaf20ac70352eeb6bf5b828462676693","lessThan":"c10ad2813e15186fb51b37a4d17fafddc99e89a5","versionType":"git","status":"affected"},{"version":"6.12.113","lessThan":"6.12.115","versionType":"semver","status":"affected"},{"version":"6.18.52","lessThan":"6.18.60","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["io_uring/waitid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8381a912c65b8de16e8a848225c7c5a56b6ea834","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf01da1a9cca4a54e5c30b8344e52c26afb87be7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c10ad2813e15186fb51b37a4d17fafddc99e89a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99232","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.247","lastModified":"2026-11-02T16:17:48.247","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"baa031b7bd2ce7502339174a42974321859ecd6a","lessThan":"e33e2718c62a602001ab549642a1aed0be797105","versionType":"git","status":"affected"},{"version":"baa031b7bd2ce7502339174a42974321859ecd6a","lessThan":"041d1a568a11a7ed7415ef1408d0c65041c1ad69","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99233","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.390","lastModified":"2026-11-02T16:17:48.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c","kernel/trace/trace_events_synth.c","kernel/trace/trace_synth.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"381f543ed35c434d5b707369aa5dcd69ecf440af","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"4472579bd1c83708b6fe623c870cdf728e947205","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"23b4106e8b35823acc79e206c7745f55b9cfd78b","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"06e816bed499fe47f39f12044382cc5d064485fb","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"5597bb8db6855fcb97a67196d227fea359bcd81c","versionType":"git","status":"affected"},{"version":"4b147936fa509650beaf638b331573c23ba4d609","lessThan":"cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c","kernel/trace/trace_events_synth.c","kernel/trace/trace_synth.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99234","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.597","lastModified":"2026-11-02T16:17:48.597","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n  # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n      events/sched/sched_waking/trigger\n  # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n      onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n      >> events/sched/sched_switch/trigger\n  # cat events/sched/sched_waking/trigger\n  hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n  hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"f21351d1c4cdcc6a68f03636a407c2af1a5e1e10","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"dba0f492703956801149cc70b39d2650a37995c3","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"a3d7ffd2409700748a495b645948fef48199206e","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"aae0ccd7326eef78dcdefffef3d1253e6f0615ca","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"8482ec5b65f606d5bbcec518e0afc69ad65ca414","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"431959fc76456cbba539279fe8967aa9391e6f23","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"d0090baf02dd08f6e909f36f0ad54a4e80f5e79b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99235","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:48.790","lastModified":"2026-11-02T16:17:48.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist->hist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data->field_var_hists[i]->hist_data->event_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n  kfree+0x154/0x420\n  event_hist_trigger_free+0x1d5/0x320\n  event_hist_trigger_parse+0x35f3/0x69e0\n  trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"a6165126b1a1b26342b55be6eb6ee23af8756aba","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"173914501b97236d7ea7dc2af7f30feddd4e1436","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"ac815a379644b2ad5008a009a3516ada31b5dd82","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"8b307d64a60548e4a74cb746f74d7ed4bd49965e","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"7a111ba0d1b74c99bc8f096565dc71945f694254","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"9631dbccd3c649b567a5aafffea6b00634183997","versionType":"git","status":"affected"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","lessThan":"7cafc82e6153f05a221be678cd649d02e06ba909","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_hist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99236","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.003","lastModified":"2026-11-02T16:17:49.003","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events_filter.c","tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"4a1a6d35359991c5d47f4bf101cfbe1475c94093","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"2a98f5d4913ec081e08e1075512cb7ec313d9f72","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"15ff3cc7f2beecc3f95d66358f20ad7b057466aa","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"b205ff58e02922ac324f931cf9eb238a3acdb048","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"5a999b5a16530898f0dbe5f8c50fd45ea72e110b","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"1008e9e0b8280d47f1ab5e9c113f666a023a9697","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"64993d970dde2a2da353e9e99595a4fa88ec27d9","versionType":"git","status":"affected"},{"version":"80765597bc587feae8dbc8ce97a0f32e12a6e625","lessThan":"5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events_filter.c","tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99237","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.213","lastModified":"2026-11-02T16:17:49.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when resetting last boot data from readers\n\nupdate_last_data_if_empty() is called from tracing_open() with O_TRUNC,\ntracing_read_pipe() and tracing_buffers_read() without trace_types_lock.\nTwo readers can both pass the LAST_BOOT test and free module_delta\ntwice, and a module notifier can update module_delta while it is being\nfreed.\n\nTake trace_types_lock in those paths and keep the callers that already\nhold it on an unlocked variant."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"32dc0042528d385d83bf458e4cf3a49c5110afea","lessThan":"92b69f6db640dadc0851762ee2e12db99f083cad","versionType":"git","status":"affected"},{"version":"32dc0042528d385d83bf458e4cf3a49c5110afea","lessThan":"d6d991afe775ab7fcf89523a2502b7ca3be56ffd","versionType":"git","status":"affected"},{"version":"32dc0042528d385d83bf458e4cf3a49c5110afea","lessThan":"1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99238","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.380","lastModified":"2026-11-02T16:17:49.380","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43","lessThan":"57408eac99b0d8a005796346d317d31f0ca4e07a","versionType":"git","status":"affected"},{"version":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43","lessThan":"dab2bd4d67ad5eaa95019a9511f8d379401b5021","versionType":"git","status":"affected"},{"version":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43","lessThan":"244c442f54601a24c86ad90572bf36fc3df41c5e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99239","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.540","lastModified":"2026-11-02T16:17:49.540","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n    [Task 1]                          [Task 2]\n    l2cap_chan_connect                l2cap_sock_bind\n      l2cap_chan_lock                   lock_sock\n      l2cap_state_change                if (sk->sk_state != BT_OPEN)\n        chan->state = BT_CONNECT\n        l2cap_sock_state_change_cb      chan->state = BT_BOUND\n                                        sk->sk_state = BT_BOUND\n          lock_sock <------------------ release_sock\n          sk->sk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk->sk_state, so since chan->state\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan->state. chan->state read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8f90405a4a6f1f1880dc07996b47bf57c712bd8a","lessThan":"85cc289eb08afa975375f838187369e68b429ee0","versionType":"git","status":"affected"},{"version":"32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b","lessThan":"820579652b24ce277e0097cd65b42bd9b7b8bf07","versionType":"git","status":"affected"},{"version":"8922c7940bae9ce4b1736dddb6362370793835c2","lessThan":"e618d928ec7f88cbeadfa3542adcac40f474e629","versionType":"git","status":"affected"},{"version":"91047a4396a8b1857a6f712a90cf33ec0012b189","lessThan":"fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","versionType":"git","status":"affected"},{"version":"0b0e2bf39cf99e458d991b9df253727e036a7d7d","lessThan":"52fe88e4ef87311eee32b45c65603e7c69e75e7d","versionType":"git","status":"affected"},{"version":"d3b739db5dc6f688a60d56da872fabaf65246032","lessThan":"10c705dd706aa93164ba41f2566f15206d6c178e","versionType":"git","status":"affected"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","lessThan":"73820561d8cbfd3364a29b8fa77f1707f26029da","versionType":"git","status":"affected"},{"version":"b66774b48dd98f07254951f74ea6f513efe7ff8b","lessThan":"d3afd7803f9bc2a8c4270199497b60158b2fc647","versionType":"git","status":"affected"},{"version":"50c38d9f42a529691e4e67ea9cedf4f0bfc8d277","versionType":"git","status":"affected"},{"version":"5.10.265","lessThan":"5.10.273","versionType":"semver","status":"affected"},{"version":"5.15.216","lessThan":"5.15.224","versionType":"semver","status":"affected"},{"version":"6.1.183","lessThan":"6.1.191","versionType":"semver","status":"affected"},{"version":"6.6.145","lessThan":"6.6.161","versionType":"semver","status":"affected"},{"version":"6.12.97","lessThan":"6.12.115","versionType":"semver","status":"affected"},{"version":"6.18.39","lessThan":"6.18.60","versionType":"semver","status":"affected"},{"version":"7.1.4","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"5.10.273","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99240","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.773","lastModified":"2026-11-02T16:17:49.773","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: error damos_commit_quota_goal() for zero target_value\n\nPatch series \"mm/damon: move zero damos quota target_value handling to the\ncore layer\".\n\nHaving zero DAMOS quota target value can cause division by zero.  DAMON\nAPI callers are checking the target value parameters to avoid that.  It is\neasy to make mistakes in some of the multiple API callers.  Move that to\nthe core layer.\n\nPatch 1 adds the corner case handling into the core layer DAMON parameters\nvalidation logic.  Patches 2 and 3 remove no more needed DAMON API callers\nside handling of the corner case in DAMON_LRU_SORT and DMON_SAMPLIE_MTIER,\nrespectively.\n\n\nThis patch (of 3):\n\nIf a DAMOS scheme has a damos_quota_goal of zero target_value,\ndamos_quota_goal() could trigger division-by-zero error.  Hence each DAMON\nAPI callers should do the zero target_value validation.  It is easy to\nmake mistakes.  Actually such bugs in DAMON_LRU_SORT and\nDAMON_SAMPLE_MTIER were found and fixed [1].\n\nIt is better to handle the corner case only once in the core layer,\ninstead of multiple places in all DAMON API callers.  One straightforward\noption is using an alternative denominator for the corner case in the\ndamos_quota_goal().  However, the zero target_value is meaningless.  In\nthis case, the quota goal is always evaluated as achieved or\nover-achieved.  The quota will only keep being reduced.\n\nSimply avoid using zero target_value by adding a check in the core layer\nDAMOS quota goal parameters validation/commit path,\ndamos_commit_quota_goal().  Update it to return an error in the case. \nAlso update its caller to propagate the error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d5482be6243b816730689099c017109eb8730dd5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cc190c4073f570fd78a9d00dd3d13a71eced5403","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"156aeda4d74e9007b56492ed1f3b5838822632be","versionType":"git","status":"affected"},{"version":"0","lessThan":"6.18.60","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.2.14","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.3.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18.60","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/156aeda4d74e9007b56492ed1f3b5838822632be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc190c4073f570fd78a9d00dd3d13a71eced5403","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5482be6243b816730689099c017109eb8730dd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99241","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:49.907","lastModified":"2026-11-02T16:17:49.907","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio.  This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\".  xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite().  The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9c87959601e80b39a45250e362e6ddfec17cb0fa","lessThan":"57c0d5281666d150c73e56e6795a4eef3ede8693","versionType":"git","status":"affected"},{"version":"9c87959601e80b39a45250e362e6ddfec17cb0fa","lessThan":"0fecc393f2060e6bc25138df32cb923ec7071c6b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-99242","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-11-02T16:17:50.040","lastModified":"2026-11-02T16:17:50.040","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327","versionType":"git","status":"affected"},{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"67aded1da114dc44808315f249bd9e7e440f799d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}]}